Sync encryption:
- AES-256-GCM encryption for all sync channels (browser sync, gist,
custom URL, folder sync, sync codes)
- Password with optional TOTP (RFC 6238) second factor
- Configurable auth TTL: session, 30/90/180/365 days, or never
- CryptoKey cached in IndexedDB — auth only needed when cache expires
AND new data exists (lastModified check runs before auth prompt)
- WebAuthn (biometric/PIN) as low-friction re-authentication gate
- Full options UI for setup, password change, and inline auth prompt
Smart reveal:
- Track which substitute values were actually sent outbound per session
- Reveal mode only replaces values that were genuinely substituted,
preventing false positives (e.g. AI using the word "user" won't be
replaced with a real username that maps to "user")
https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn
Claude
8198620b8a