Security

An honest account of what Palarid's architecture protects against — and what it does not.

Last reviewed: 14 September 2026

The strongest security property

What browser storage does not protect against

Your device's own protections — screen lock, disk encryption, account separation — are what actually guard this data. Palarid sits inside them; it does not replace them.

What we have hardened

• No secrets in the codebase. Palarid ships no private API keys. The only keys involved are ones you choose to add.
• Keys are never placed in URLs, never logged, and never sent anywhere except the provider you selected.
• Key fields are masked, autocomplete is disabled, and the storage limitation is stated at the point of entry rather than buried in a policy.
• Destructive actions are protected — irreversible deletions require explicit confirmation, take a snapshot first, and offer a short undo window.
• Corrupt-storage recovery — malformed local data is handled without breaking the app, and quota exhaustion is caught rather than silently losing writes.
• Non-destructive migrations — an upgrade backs up existing data before converting it, and is safe to re-run.
• Third-party surface is small — a map library, a QR decoder, and whichever AI provider you opt into. That list is the whole of it apart from the two things named here. Palarid runs no analytics of its own. Advertising is as stated in Privacy §4b — Explore tools only, and off as of this review; when it is on, the ad network sets its own cookies and we say so rather than claiming otherwise. Our host injects its own page-speed measurement script at the edge; it is disclosed on the cookies page.
• The code playground is sandboxed. The Live Coder tool runs your HTML, CSS and JavaScript in an isolated frame with its own opaque origin. Code executed there cannot read your stored data, your API keys, or anything else on the page.
• Injected markup cannot phone home. The Content-Security-Policy blocks any form from submitting to another domain, blocks <base> injection (which would silently repoint every script on the page at an attacker's server), and blocks plugin content entirely.
• Powerful browser features are denied by default. Camera, microphone, location and screen capture are permitted only for Palarid itself and only because named tools use them. Bluetooth, USB, serial, MIDI, payment and device sensors are switched off at the HTTP layer, so a bug could not reach them.
• No referrer is sent on outbound links. Palarid links to debt charities, NHS pages and crisis resources. Those sites are told nothing about where you came from.

Fixed in July 2026

Recording these rather than quietly patching them, because a security page that only lists strengths is not a security page.

• The code playground was not sandboxed. The Live Coder tool rendered your code in a frame that shared Palarid's origin, which meant script running there could read everything in local storage — journal entries, financial figures, health logs, saved API keys, and the password vault while it was unlocked. It now runs with an opaque origin and no access to the parent page. Fixed 27 July 2026. We have no evidence it was exploited; the tool requires a person to type or paste code themselves.
• Two third-party scripts loaded without integrity checking. The map and QR libraries are loaded from public CDNs. They are version-pinned, but a compromise of either CDN would have executed attacker code with full access to your data. The prerequisite attribute is now in place; the integrity hashes themselves are the next step (see below).

Fixed since

• Subresource Integrity hashes are now applied to both CDN libraries (v4.68, September 2026). The map and QR libraries are also no longer loaded on every page: the browser asks for them, with their hash, only when a tool that needs them is opened. If a CDN ever served a different file, the browser would refuse to run it.
• The password vault now derives its key at 600,000 PBKDF2-HMAC-SHA256 iterations (v4.51), which is the current OWASP guidance. Vaults created at the old 100,000 still open, and are re-encrypted at the new count on the first successful unlock — the new copy is written only after the password has been proven, so nothing can be locked out by the upgrade.

Known gaps

Still open, stated plainly.

• Content-Security-Policy is partial. The directives that could be verified safe are enforced. A full policy including script-src is deployed in report-only mode while the real allowlist is measured. The app contains a large amount of inline JavaScript, so a script policy strict enough to actually stop cross-site scripting requires restructuring first.
• No end-to-end encrypted sync yet. Until it exists and has been reviewed, we will not use the word "encrypted" to describe stored data.
• No formal third-party penetration test has been carried out.
• Palarid is maintained by a very small team. Response times to reports will reflect that.

Reporting a vulnerability

If you find a security issue, please report it before disclosing it publicly. We will confirm receipt, investigate, and credit you if you would like to be credited.

• Use the report form and mark it as a Safety concern.
• Please include steps to reproduce. Do not include other people's personal data.
• Please do not test against other users, degrade the service, or access data that is not yours.

If you are worried about your own data

• Export a backup now — Settings → Data → Export. It is a plain JSON file you control.
• Remove any provider key you no longer use.
• Clear a category rather than everything, if you only want to remove one kind of record.

← Back to Trust Centre