Security

Last updated November 13, 2026.

How the site is built

• Static site, no server-side data. There are no accounts, logins, forms or databases. What people write is never sent to a server.
• Optional on-device encryption. "Lock my story" encrypts saved words with a key derived from the person's password (Argon2id, then XChaCha20-Poly1305 from the vetted libsodium library). A separate recovery key is shown once. The page locks after 5 minutes without use.
• No third-party code. No analytics, ads, trackers, CDNs or outside fonts. The crypto library is served from this site and checked with Subresource Integrity.
• Strict browser protections. Content-Security-Policy with no inline scripts or styles, Trusted Types, HSTS, frame blocking, cross-origin isolation headers, no referrer, and a Permissions-Policy that turns off camera, location and payment (the microphone is allowed only for this site's voice button).
• Safe page updates. The app writes text with safe DOM methods, not HTML strings. Links in the Local help data are limited to https, tel, sms and mailto, and the data files are checked by a validator before publishing.

Code file hashes for this release are listed in hashes.txt.

This is our own review, not an independent audit. We plan an outside review before adding accounts or sync.

Report a security problem

Please email gnrmadlab42@gmail.com with "Security" in the subject. Tell us what you found, the page or file, and steps to reproduce. Our machine-readable contact is at /.well-known/security.txt. We aim to acknowledge reports within 7 days.

• In scope: tellitonce.app and its files.
• Please don't: run denial-of-service or high-volume scans, try social engineering, or access anyone else's device or data.
• Safe harbor: if you act in good faith and follow this page, we will not pursue legal action against you, and we will credit you if you want.
• We are a small, unfunded project and cannot pay bug bounties.