Pairing uses HMAC. Reads are jailed with realpath under ABSPATH. Files larger than 2 MiB are skipped. The secret stays on the site page until Pair succeeds.
It does not hash the site, run YARA, or clean anything. Clean and harden are refused on connector and SFTP; they need SSH. Calling it a “security plugin” in the WordPress sense would be a lie.
Download is from the authenticated account, not the public sitemap. See connector and agencies.