Most of this page is about a single idea: a program that holds your production credentials should be built so that a bug in its interface cannot hand them out. Everything below is enforced in the Rust core, not by the interface agreeing to behave.
That box is drawn by your operating system, not by the application window. A compromised interface cannot repaint it, cannot click it, and cannot make a key replacement look like a first connection. The safe button is the one the keyboard reaches first.
Credentials are decrypted in the Rust core, at the moment a connection opens, and handed to the socket. No interface code path can enumerate your vault, because no command exists that would answer.
Every credential is bound to its whole route — host, port, user, proxy and jump host. Redirect the connection and the credential stays behind, even when the request comes from inside the app.
Pop-out windows render content that arrived from a machine you do not control. They are allowed exactly what they need and nothing else — a rule enforced in the core, not by the window agreeing to behave.
The vault format is documented, the source is public, and every claim on this page corresponds to code you can read. Nothing here has been audited by anyone outside the project — that is worth knowing before you decide how much to trust it.