Security

In plain words: what protects your data, and what does not.

Login

One password, stored as a bcrypt hash.
Optional two-step login with an authenticator app and recovery codes. Optionally trust a browser for 30 days to skip the code (never the password).
Five wrong tries pause logins for 15 minutes, doubling up to a day.
Sessions last 30 days, are tied to the browser, and use HttpOnly and SameSite=Strict cookies (Secure on HTTPS). Changing the password or choosing Log out other devices ends every other login.
Every change after login needs a security token, and requests from other websites are refused.

Encryption

One passphrase locks Info's encrypted tabs, Links' encrypted tabs and backup files. Keys are made in your browser and wrapped with the passphrase (PBKDF2, 600,000 rounds); backup files use PBKDF2 with 310,000 rounds and AES-256-GCM. A lost passphrase and a lost recovery key mean lost data.

Your data

Data lives in site-data inside the site folder, locked three ways: a deny-all .htaccess, an empty index file, and data files that are PHP files answering 404 in a browser even on a server that ignores .htaccess. Nothing in site-data can run as a script.

How updates are checked

The site contacts only GitHub hosts, over HTTPS, and checks every redirect.
The download is compared with the size and SHA-256 listed for that release. This catches damaged or partial downloads.
The zip then gets the same full check as an uploaded one: safe names, every file whole, PHP files readable, a newer version, room on the disk.
Nothing installs until you read the changes and type your password. A snapshot is taken first, and the site rolls back on its own if it cannot answer afterwards.

What the checksum does not prove. It comes from the same GitHub account as the zip, so it cannot show that a release is genuine. Releases are not signed. Keep two-factor login on the GitHub account, and read the changelog before you install. Only install zips from a source you trust.

The daily check is off by default. While it is off the site makes no request to GitHub unless you press Check Now.

Reporting a problem

For a security problem, message @Jackpison on Telegram rather than opening a public issue.