The latest articles on DEV Community by Achyuth S (@oneakira). https://dev.to/oneakira https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4131475%2F1aade8c1-550a-4f1c-ab2d-8c8e1fffdb2e.jpg https://dev.to/oneakira en Achyuth S Mon, 21 Sep 2026 06:09:18 +0000 https://dev.to/oneakira/i-shipped-client-side-encryption-for-kagelin-heres-the-honest-threat-model-including-everywhere-1lph https://dev.to/oneakira/i-shipped-client-side-encryption-for-kagelin-heres-the-honest-threat-model-including-everywhere-1lph <p>A brief intro on <strong>Kagelin</strong>, its an AIO productivity tool that doesn't distract you. Task, habit, calendars are basis of this tool and much more planned.</p> <p><strong>Kagelin</strong> now encrypts your data client-side. The server never sees the key so a DB leak, a compromised server, or a legal request only gets ciphertext.</p> <p>What's encrypted: task text, habit names, project/label names, calendar event details, push notification content.</p> <p>What's not: dates, priorities, completion status, due dates. Those stay readable server-side so reminders and sorting still work. Same for basic account info like email, item counts.</p> <p>What it doesn't protect against: a compromised browser tab (XSS), or a compromised build pipeline. Key rotation also isn't built yet.</p> <p>Short version: Kagelin can't read what you wrote. It can see that your account exists and roughly how much is in it.</p> <p><a href="https://app.kagelin.app/" rel="noopener noreferrer">app.kagelin.app</a> · <a href="https://github.com/Achyuth072/kagelin" rel="noopener noreferrer">github.com/Achyuth072/kagelin</a> (AGPL-3.0)</p> <p>If you've shipped E2EE before, how'd you handle key rotation?</p> webdev productivity security typescript