Where your data lives on Linux

Everything SubnetSlinger saves — your inventory, incidents, logs, runbooks, saved hosts, and the Vault — stays on your machine. There is no cloud sync.

The basics: your data lives in two folders under your home directory. ~/.config/SubnetSlinger holds settings and saved work (inventory, incidents, runbooks, saved hosts, the activity log, the Vault, the license). It follows the XDG spec, so if you've set XDG_CONFIG_HOME it goes there instead. ~/Documents/SubnetSlinger (your Documents folder, if it has another name) holds exports, captures, reports, the server drop folders and crash.log. To back up your setup, back up both folders (or use File ▸ Back up & restore your work…). To start completely fresh, close the app and remove them.

Going deeper — saved secrets: passwords you let the app remember (an SSH host password, the licensing token) are NOT stored in plain text. On Linux they're encrypted with AES-256-GCM. The key is held in your desktop's secret service — the system keyring (GNOME Keyring / KWallet), reached through libsecret's secret-tool command (install libsecret-tools if it's missing) — so the key is never written to disk next to the data. If no keyring is present, the app derives the key from your unlocked Vault instead. With no keyring AND a locked Vault, the secret is simply not saved: it's kept for this session only and you'll be asked again next time. Either way there is no plaintext key file sitting beside the ciphertext. This is the Linux counterpart to Windows DPAPI.

Without a keyring: if secret-tool is missing (sudo apt install libsecret-tools; Fedora: libsecret) and the Vault is locked, your sign-in and saved passwords last only for this session. Pro then asks you to sign in again by email once the 30-day offline grace runs out. Install secret-tool, or unlock the Vault, to keep them.

Migration note: earlier versions kept the key in a 0600 ~/.config/SubnetSlinger/secret.key file next to the data — which put the key and the ciphertext in the same folder, so a copied config carried both. That legacy key is now read once to re-wrap your existing secrets under the keyring, then deleted.

Good to know: a saved secret is only as protected as your login account and your keyring. Full-disk encryption (LUKS) and a strong login password are still the real perimeter; this keeps secrets off disk in plaintext, it isn't a substitute for OS-level security.