Priyanshu
ReportSole developer and maintainer of Skiff, an SSH client that records what was done, gates who may do it, and can demonstrate that the record has not been altered. I am a first-year Computer Science and Engineering student at Karnavati University in Ahmedabad, India, and Skiff is my own work — designed, built and maintained by me, published in the open since 2026. Skiff started from a file called servers.md: a plaintext list of hosts and passwords, which is how access to production is actually managed at most small companies. The project exists because that file should not be the state of the art.
Skiff
An SSH client that adds a governance layer to the client itself, so no server-side infrastructure is required. Small engineering teams run production servers over SSH and have no way to prove who did what on them. The tools that solve this properly — Teleport, CyberArk, StrongDM — are built for organisations that can run bastion infrastructure, pay per seat and staff an administrator. The tools such teams actually use — Termius, PuTTY, OpenSSH — store credentials and open terminals, but record nothing, gate nothing and prove nothing. The teams with the least margin for a security incident therefore have the weakest controls. Skiff closes that gap with three mechanisms, all local: 1. A tamper-evident audit log. Every action is hash-chained — each entry carries the SHA-256 of the one before it, over a canonically encoded byte sequence. Editing an entry, deleting one, or recomputing a hash all break the chain and are detected. Verification runs in the application, so the claim is demonstrable rather than asserted. 2. Approval-gated access. Hosts can be tagged so that connecting requires a second person's approval, opening a time-limited window scoped to that requester and that host. A request cannot be self-approved. 3. Session recording and command guardrails. Sessions are recorded in asciicast format and replayable. Dangerous commands are caught before they run — recursive deletes from root, fork bombs, piping the network into a shell — including when hidden behind a harmless prefix. Credentials are held in a local vault with an Argon2-derived key. There is no account, no server-side component and no telemetry. Status: four public releases. The server build reached v0.3.0 and is still maintained; the desktop app shipped v1.0.0 in September 2026. 167 automated tests cover the audit chain, approval rules, encryption and terminal parsing. CI builds and tests on Windows, macOS and Linux for every change, and every release ships a SHA-256 checksum.
Skiff Desktop
The desktop application build of Skiff, for Windows, macOS and Linux. It takes the same audit and approval engine as the self-hosted server build and removes the requirement to deploy anything, so a single operator gets the same guarantees a team gets from running a server. Built with Electron and React over a shared TypeScript engine, with SQLite for local storage and Argon2 for key derivation. Both front ends inherit the same audit and approval logic, so the guarantees cannot drift apart between them. v1.0.0 shipped in September 2026 for Windows and Linux. macOS builds are produced by continuous integration but cannot yet be distributed: without Apple notarisation, macOS refuses to open them.
Signing certificates — reach the users the software already supports
Apple Developer Program, approx. INR 9,000/year. Without it macOS refuses to open the builds CI already produces, so the download page marks macOS unavailable for that reason alone — the entire barrier is the fee. A Windows code-signing certificate (approx. INR 12,000/year) is a contingency: unsigned installers trigger SmartScreen warnings, and some antivirus blocks the app writing its own data directory. SignPath has been applied to; if granted, this is not claimed.
Test infrastructure — servers and clean machines
Skiff is an SSH client, so testing needs real servers: multiple Linux distributions, varying OpenSSH versions and auth configurations, jump-host topologies, and conditions reproducing timeouts and refused connections. It is currently tested against one machine and a laptop. INR 36,000 covers twelve months of test servers; INR 18,000 covers machines kept clean for pre-release checks. The worst v1.0.0 defect was invisible in development.
Maintainer time — six months, part-time
INR 35,000 a month for six months, alongside full-time study. This funds the work itself: notarised macOS releases, verified automatic updates across all platforms, an expanded test matrix against real servers, audit-log export a third party can verify independently, and documentation with a contributor on-ramp so the project is not dependent on one person. Unpaid evening time is why a first macOS release has slipped repeatedly.
Full request
The three plans above, plus approx. INR 15,000 for domain renewal, release hosting and CI overage. Unspent funds returned. Six milestones, each publicly verifiable in the repository: signed Windows builds; a notarised macOS release, all three platforms for the first time; automatic updates verified end to end; an expanded test matrix public in CI; audit-log verification usable by a third party; documentation and a public report on the grant's use.
Ongoing maintenance
Recurring support for continued maintenance: security fixes, dependency updates, release engineering across three platforms, and responding to issues. Skiff has no revenue and is maintained by one person.