RustDesk is a remote desktop app in the mould of TeamViewer and AnyDesk. Install it on two machines, read the ID and one-time password off the remote one, and you can see and control its screen, move files, chat and open a terminal. It runs on Windows, macOS, Linux, Android and iOS, and it works out of the box with no configuration.
What sets it apart is who runs the servers. By default connections are brokered by RustDesk's public rendezvous and relay servers, but you can run your own with the open-source server and point every client at it, so the traffic and the device list stay on hardware you control. That makes it a common choice for IT helpdesks, families supporting relatives and anyone who has hit TeamViewer's commercial-use limits.
It is one of the most starred apps on GitHub, with about 127,000 stars and 518 contributors, at version 1.5.0 when scanned. The client is AGPL-3.0 and written in Rust with a Flutter interface. A paid Server Pro adds features such as an address book, access control and a web console; the free server is enough for most small setups.
- Repository: github.com/rustdesk/rustdesk
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: Rust. Stars: 127.1K. Forks: 20K. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 59f2953
Who it is for
Anyone who supports other people's computers, small IT teams that want remote access without a per-seat licence, and people who want their remote sessions to go through a server they run.
Getting started
1. macOS (Homebrew)
brew install --cask rustdesk2. Windows (winget)
winget install RustDesk.RustDesk3. Linux (Flathub)
flatpak install flathub com.rustdesk.RustDeskAndroid builds are on F-Droid and the GitHub releases page. To use your own server, run the separate rustdesk-server project and enter its address under Settings, Network, ID/Relay server on each client.
Safety scan
We cloned rustdesk/rustdesk at commit 59f2953 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries, no packed code and no bare-IP URLs across about 226,000 lines, most of them Rust.
- Eight of the 11 pattern hits are persistence: the Debian post-install script and the Linux and macOS code that register RustDesk as a systemd service or a LaunchAgent. That is how unattended access works, and it only happens when you install the service, but it means the app keeps running after you close the window.
- The three api.telegram.org hits are the optional two-factor feature, which sends login codes to a Telegram bot whose token you supply in src/auth_2fa.rs; the third is a test string in src/common.rs. Nothing is sent to Telegram unless you set it up.
- 82 known advisories, none critical, 16 high, in the Rust lockfiles. The high ones are in the openssl crate (0.10.68), quick-xml and libgit2-sys, mostly memory-safety and denial-of-service bugs in parsing paths; worth an update upstream, not a sign of anything hidden.
- 11 workflows, none using pull_request_target, and 88 of 89 third-party actions pinned to a commit, which is unusually careful. Seven build.rs scripts compile native code at build time, normal for a Rust desktop app. Security policy and licence present; no Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 11 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 7 Cargo build scripts. 1 installer script |
| Committed binaries | None. |
| CI workflows | 11 workflows. None use pull_request_target. 1 of 89 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, learn.microsoft.com, stackoverflow.com, man7.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 82 advisories across 1,159 pinned packages: 0 critical, 16 high, 16 moderate, 11 low, 39 unrated. Cargo.lock: 1,033 packages, 70 advisories; libs/portable/Cargo.lock: 33 packages, 0 advisories; libs/virtual_display/Cargo.lock: 141 packages, 16 advisories. |
| Project hygiene | Has security policy, licence file. Missing automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (11)
| Where | Rule | Match |
|---|---|---|
| res/DEBIAN/postinst:24 | persistence | systemctl enable rustdesk |
| src/auth_2fa.rs:159 | exfil-host | let url = format!("https://api.telegram.org/bot{}/sendMessage", bot.token_str); |
| src/auth_2fa.rs:166 | exfil-host | let url = format!("https://api.telegram.org/bot{}/getUpdates", bot_token); |
| src/common.rs:3236 | exfil-host | "https://api.telegram.org/bot123/sendMessage", |
| src/platform/linux.rs:2869 | persistence | "{cp} systemctl enable {app_name}; systemctl start {app_name};" |
| src/platform/macos.rs:229 | persistence | let agent_plist_file = format!("/Library/LaunchAgents/{}", agent); |
| src/platform/macos.rs:403 | persistence | "/Library/LaunchAgents/com.carriez.{}_server.plist", |
| src/platform/macos.rs:448 | persistence | let agent_plist_file = format!("/Library/LaunchAgents/{}", agent); |
| src/platform/macos.rs:980 | persistence | let agent_plist_file = format!("/Library/LaunchAgents/{}", agent); |
| src/platform/macos.rs:1186 | persistence | let agent_plist = format!("/Library/LaunchAgents/com.carriez.{}_server.plist", app_name); |
| src/server/input_service.rs:866 | persistence | // There's a strange bug when running by `launchctl load -w /Library/LaunchAgents/abc.plist` |
Installer scripts (1)
- flutter/run.sh, 10 lines
Worst known vulnerabilities (24 of 82)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-22q8-ghmq-63vf | high | libgit2-sys@0.14.2+1.5.1 | libgit2-sys affected by memory corruption, denial of service, and arbitrary code execution in libgit2 |
| GHSA-8c75-8mhr-p7r9 | high | openssl@0.10.68 | rust-openssl has incorrect bounds assertion in aes key wrap |
| GHSA-ghm9-cr32-g9qj | high | openssl@0.10.68 | rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check |
| GHSA-hppc-g8h3-xhp3 | high | openssl@0.10.68 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer |
| GHSA-pqf5-4pqq-29f5 | high | openssl@0.10.68 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 |
| GHSA-xp3w-r5p5-63rr | high | openssl@0.10.68 | rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs |
| RUSTSEC-2026-0194 | high | quick-xml@0.30.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.30.0 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| RUSTSEC-2026-0194 | high | quick-xml@0.31.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.31.0 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| RUSTSEC-2026-0194 | high | quick-xml@0.37.5 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.37.5 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| GHSA-3g6h-r5qx-f6hq | high | quinn-proto@0.11.15 | Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled |
| GHSA-qfwj-vfxf-92j2 | high | quinn-proto@0.11.15 | Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed |
| GHSA-m65q-v92h-cm7q | high | users@0.11.0 | users may append `root` to group listings |
| GHSA-r8w9-5wcg-vfj7 | high | mio@0.8.5 | Mio's tokens for named pipes may be delivered after deregistration |
| GHSA-pg9f-39pc-qf8g | moderate | crossbeam-channel@0.5.13 | crossbeam-channel Vulnerable to Double Free on Drop |
| GHSA-wrw7-89jp-8q8g | moderate | glib@0.18.5 | Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` |
| GHSA-h97m-ww89-6jmq | moderate | idna@0.5.0 | `idna` accepts Punycode labels that do not produce any non-ASCII when decoded |
| GHSA-4fcv-w3qc-ppgg | moderate | openssl@0.10.68 | rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch` |
| GHSA-phqj-4mhp-q6mq | moderate | openssl@0.10.68 | rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers |
| GHSA-rpmj-rpgj-qmpm | moderate | openssl@0.10.68 | rust-openssl ssl::select_next_proto use after free |
| GHSA-xv59-967r-8726 | moderate | openssl@0.10.68 | rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding |
| GHSA-2mjx-qc3c-rqvc | moderate | rustls@0.23.28 | Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries |
By the numbers
| Stars | 127.1K |
|---|---|
| Forks | 20K |
| Contributors | 518 |
| Commits | 11.6K |
| Open issues | 116 |
| Open pull requests | 89 |
| Releases | 40 |
| Latest release | 1.5.0 |
| Licence | AGPL-3.0 |
| Main language | Rust |
| Project age | 6 years |
| Last push | Oct 26, 2026 |
| Tracked files | 1,060 |
| Lines of code | 225.9K |
| Checkout size | 18 MB |
Lines by language: Rust 182.5K, Markdown 7,718, Python 6,552, C 5,750, C++ 5,671, YAML 4,627.
Questions
Is RustDesk free?
Yes. The client is free and open source under AGPL-3.0, and the basic self-hosted server is free too. RustDesk sells a Server Pro licence with extra management features, which you only need for larger teams.
Do I need to run my own server?
No. Out of the box RustDesk uses the project's public servers to connect devices, and sessions are end-to-end encrypted. Self-hosting is optional, for people who want the connection metadata and relayed traffic on their own machine.
Is RustDesk safe to install?
The scan found nothing malicious. The real risk with any remote desktop tool is social engineering: never install it or read out your ID and password because a caller you do not know asked you to. The project's own README warns against misuse.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.