Security

Amazify treats local DevTools access, its native bridge, plugin installation, the remote catalog, and application updates as explicit security boundaries.

Local control plane

DevTools and bridge listeners bind to loopback rather than public interfaces. Native bridge requests require session credentials, pass origin checks, and are restricted to exact allowlisted commands. A DevTools binding fallback keeps privileged operations inside the validated target path.

Catalog and plugin installation

Schema-v2 entries pin an immutable Git source commit and declare every package file's expected byte size and SHA-256. Amazify validates redirects and download bounds, stages the package, checks all content, then installs it under the plugin data directory.

Application updater

The updater accepts eligible final releases from the official repository, validates expected installer assets and their digest, and requires explicit user confirmation before opening the normal installer.

Plugin execution risk

Enabled plugins run inside Amazon Music's signed-in renderer. Permission declarations explain intended capabilities, but they are not a complete sandbox. A malicious or compromised plugin could read or alter renderer-visible data and interactions.

Downloaded packages start disabled.
Prefer maintained stock packages and inspect exact source revisions.
Treat network access and broad DOM behavior as higher risk.
Disable a plugin immediately if it performs unexpected actions.

Meaning of stock: the exact catalog revision was reviewed and tested by the Amazify project. It does not mean formally audited, risk-free, or endorsed by Amazon.

What Amazify does not intend to collect

Amazify does not replace Amazon Music's account or playback services and does not intentionally read or export passwords, cookies, DRM material, or downloaded music. Amazon Music remains responsible for account data, streaming, offline media, and notifications.

Operational safety

Install only from the official GitHub release.
Do not bypass a digest or catalog validation failure.
Keep Amazon Music and Amazify current.
Review logs before sharing them and remove account-specific information.
Do not publish bridge credentials, tokens, cookies, or private account data.

Report vulnerabilities privately

Do not open a public issue for a vulnerability. Use GitHub private vulnerability reporting with affected versions, reproduction steps, impact, and a minimal proof of concept.

Open private vulnerability reporting

Detailed project documents

The repository contains the maintained security policy, threat model, and network endpoint inventory.