Security model

Non-custodial by design

Keys are encrypted client-side with Argon2id + AES-256-GCM and only ever decrypted in your browser at signing time. The server stores ciphertext and never receives your vault password.

Sessions

Login is Discord OAuth. Only one active session per account is allowed — signing in on a new device revokes the previous one, so credentials can’t be shared across people.

Hardening

• Strict nonce-based Content-Security-Policy blocks injected inline scripts.
• Server-side requests are guarded against SSRF (private-range and rebinding protection).
• Every workspace query is tenant-scoped; endpoints and tasks never leak across accounts.
• Admin actions sit behind a separate signed session.