A brief intro on Kagelin, its an AIO productivity tool that doesn't distract you. Task, habit, calendars are basis of this tool and much more planned.
Kagelin now encrypts your data client-side. The server never sees the key so a DB leak, a compromised server, or a legal request only gets ciphertext.
What's encrypted: task text, habit names, project/label names, calendar event details, push notification content.
What's not: dates, priorities, completion status, due dates. Those stay readable server-side so reminders and sorting still work. Same for basic account info like email, item counts.
What it doesn't protect against: a compromised browser tab (XSS), or a compromised build pipeline. Key rotation also isn't built yet.
Short version: Kagelin can't read what you wrote. It can see that your account exists and roughly how much is in it.
app.kagelin.app · github.com/Achyuth072/kagelin (AGPL-3.0)
If you've shipped E2EE before, how'd you handle key rotation?
Top comments (0)