Security Overview

The public link exposes the card fields required by agents: status, boundaries, allowed actions, ask-first rules, public resources, JSON, Markdown, schemas, and the public request key.

The private link unlocks private notes and inbox notes. Signing in verifies account identity but does not unlock private content. If you lose the private link, locked content cannot be recovered. Anyone who receives the link fragment can use it, so treat it as bearer access control.

• Every card is encrypted at creation. Add a private note section anytime; your private link appears after you save with that section. Copy it while this device still holds the key. We cannot restore it later.
• Inbox is on by default. Turn it off when creating or editing; you can turn it back on anytime.

1. Open browser DevTools, then open the Network tab.
2. Create or edit a card with a unique private note, for example purple elephant private test.
3. Inspect the request to /api/cards.
4. Confirm the private phrase is not present in the request body.
5. Confirm the request contains only the encrypted private blob: ciphertext, nonce, and algorithm.
6. Open the public link and confirm locked content is unavailable. Open the private link and confirm it decrypts in the browser.

The server accepts one encrypted shape for private card fields. The secret key is not included in this object. It is carried by the private link fragment as #key=....

{
  "encryptedPrivateBlob": {
    "algorithm": "aes-gcm-v1",
    "ciphertext": "base64url(AES-GCM ciphertext and tag)",
    "nonce": "base64url(12 random bytes)"
  }
}

Operators can access operational metadata required to run the service, such as account, card, delivery, audit, and usage metadata. Locked card content and inbox notes are browser encrypted; the operator cannot decrypt them without the private link secret.

Send security reports to support@humanisoffline.com with enough detail to reproduce the issue. Please do not access other accounts or disrupt the service while testing.