The credential is never the first thing sent.
Host keys verified during key exchange
An SSH connection is checked before authentication, not after: the key the server presents is fingerprinted (SHA-256, in the same format `ssh-keygen -lf` prints) and compared against what was accepted for that host before. A host that fails the check never sees a credential.
A changed key stops the connection dead
If a host answers with a different key than last time, the connect is refused outright and the old and new fingerprints are both shown. Getting past it is deliberate work — edit the connection and clear its trusted key — because the alternative is a password handed to whatever is impersonating the server.
First contact is a decision, not a default
An unknown host puts its fingerprint in front of you with the command to verify it on the server itself. Cancel is the default button and the Escape key, so dismissing the dialog can never accidentally trust a key.
Credentials in the OS keyring
Saved passwords, key passphrases and FTP credentials are encrypted by the platform keychain — DPAPI, Keychain, or libsecret — and tied to this machine and user account. If the keyring is unavailable, the app says so and refuses to save the password rather than falling back to a plain-text file.
Plain FTP is labelled, not hidden
SFTP and FTPS are encrypted; plain FTP is not, and a session using it is badged "unencrypted" in the connection list with a warning at setup. Accepting a self-signed FTPS certificate is a separate, explicit opt-in that keeps the channel encrypted but unverified — and says exactly that.
Authentication you already use
Password, private key file with optional passphrase, or your running SSH agent. Nothing new to provision, and no credential is copied anywhere Space Wizard controls.
Read-only until you select something.
A scan reads; it does not write
Locally it lists directories and reads sizes. Remotely it runs `find`, `df` and `sha1sum` — enumeration and hashing, nothing that modifies state. Nothing is moved, changed or removed unless you select files and confirm.
File contents never cross the wire
Remote duplicate detection hashes on the remote host, so what returns is a list of digests. The only case where bytes are read across the connection is a host with no shell at all — and even then the first pass reads 4 KB per candidate file, not the file.
Deletion is reversible where the OS allows it
Local deletes go through the system recycle bin or trash, recoverable the normal way. A remote filesystem has no trash to move a file into, so remote deletes are permanent — the button changes from "Move to trash" to "Delete" so the difference isn't a surprise.
Keep-one protection on duplicates
Selecting every copy in a duplicate group is blocked and flagged in the UI. There is no path through the duplicates view that removes the last remaining copy of a file.
Elevation is opt-in and visible
Without Administrator rights, parts of a Windows system drive simply can't be read. Space Wizard says which parts and how many, and offers a relaunch — rather than reporting a smaller number as if it were the truth.
Licensing without a phone-home habit
Activation validates a key once against the licensing service and caches the result. If the server is unreachable later, the cached tier is kept rather than downgrading a paying user. Air-gapped machines activate from a signed licence file bound to that device, with no network at all.
No account. No sync. No telemetry.
Scanning never touches the network. Space Wizard makes exactly two outbound calls in its whole life: checking a licence key when you activate one, and checking for a new version once after launch. Both are optional — there is an offline licence file for machines that never go online at all.
What we are not claiming.
Trust-on-first-use, not a managed key store
Host-key trust works the way OpenSSH's known_hosts does: the first key you accept becomes the expected one. It protects every connection after the first. If your threat model rules out first-contact trust, verify the fingerprint out of band before accepting it — the dialog shows you the exact command.
Deletes are deletes, not secure erase
Space Wizard removes files; it does not overwrite them. If a file needs to be hard to recover afterwards, that is DuplicateDuster's secure-erase mode or full-disk encryption, not this.
Beta builds are not code-signed yet
The 1.0 beta ships unsigned on every platform: SmartScreen will warn on Windows and Gatekeeper will warn on macOS, and macOS in-place updates stay manual until signing is in place. We would rather say so here than have you find out at install time.
No central management plane
There is no fleet console, no policy push and no server-side audit log — Space Wizard is a desktop tool with a local config. If you need centrally managed scanning across a fleet, tell us what that has to look like before you buy.
Want the implementation detail?
Scan architecture, transport negotiation, the hashing pipeline and licence enforcement — written for review, not for a brochure.