Security
Ruffle3D is local-first: your designs are stored and processed on your own computer. Most of the risks that come with cloud CAD simply don't apply.
How Ruffle3D handles your data
- No cloud storage. Projects, versions and thumbnails are kept in your browser's storage on your device. We don't receive them.
- No account. You don't need to sign in to use Ruffle3D, so there are no stored passwords to leak.
- Local processing. Geometry is computed by the OpenCascade kernel, running as WebAssembly on your device. Rendering uses your GPU through WebGL.
- Local server only. The offline launchers start a web server that listens only on
localhost(port 47830). It serves the app's files and nothing else, and it isn't reachable from other computers. - No tracking in the app. The application contains no analytics, advertising or third-party trackers.
- Integrity. Every download has a published SHA-256 checksum on the download page, so you can confirm the file hasn't been altered.
Air-gapped and restricted networks
The download package runs with no network connection at all. Copy it onto the machines and run it; nothing needs to be activated or to phone home. Contact us if you need help deploying it.
Reporting a vulnerability
If you think you've found a security problem in Ruffle3D or this website, report it privately on GitHub (please don't open a public issue) with:
- a description of the issue and its impact;
- steps to reproduce it, or a proof of concept;
- the version you tested.
We'll acknowledge your report within three business days and keep you updated while we investigate. Please give us reasonable time to fix the issue before you disclose it publicly. We won't take legal action against good-faith research that respects users' privacy and doesn't disrupt services.