How to report a security problem
Email [email protected] with the route and the time. Do not send a master key or note text.
We do not publish a response-time promise. Security reports are not paid, and there is no bounty program.
Testing a workspace you control
You may test a workspace you control and report a product flaw to [email protected]. Include the route and the time. Do not send a master key or note text. Do not read another workspace's notes. Do not try to knock Noteheld offline.
What a leaked key reaches
Note text is stored in the clear. Version 1 does not encrypt note bodies end to end. The database file is the notes.
A leaked master key can read and change the workspace, mint keys, rotate the master key, and download a recovery kit, until you revoke it or rotate it. A leaked master key can also rotate the master key. That locks you out. Revocation takes effect on the next request. There is no auth cache in this version.
Rotation revokes the old master key. A recovery kit that contains that old key stops working. Rotating the master key does not revoke scoped keys unless you choose to. If the old key leaked, revoke them too.
A leaked folder key can read or write inside that folder until you revoke it or it expires. It cannot mint keys. The check uses the note's current path, including after a move.
A leaked view link can read only the note or folder it was minted for. The secret is in the URL fragment. The page sends it as a header, then removes it from the address bar. We store only a hash. Our logs are designed to drop that header. View links are part of Pro. You can choose no expiry. A view link with no expiry works until you revoke it. It is not a safer link.
What our process redacts
Our process rewrites /k/ paths to /k/:redacted before any log line. A proxy Noteheld does not operate can still store the raw URL.
Our logs are built to drop authorization headers, the session cookie, the view-link header, and note bodies. A test checks that log sink.
A key that is unknown, mistyped, expired, or revoked returns the same error body.
A key or a passkey sets an HttpOnly session cookie. The cookie value is a random id stored as a SHA-256 hash. It is not the master key. It stays active for 14 days after the last use and ends 30 days after it starts, on every plan. Revoking the key drops sessions tied to that key. /api/v1 and /mcp ignore the cookie and require a key in the Authorization header. Cookie-authenticated changes require a same-origin request.
What a report covers
Content returned to agents is marked as stored data and carries provenance. This does not stop a model from following text inside a note. Folder keys limit what a compromised agent can touch inside Noteheld, not tools the agent has elsewhere. A warning that the text looks like instructions does not block the read. The human UI sanitizes markdown and does not load remote images.
The split across database files is not a boundary between customers. The live database files are plaintext. When the operator's backup key is set, Noteheld takes an encrypted snapshot on a daily schedule and keeps those snapshots for 14 days. A snapshot is a copy of the notes. Restoring an older backup can bring back a key that was revoked after the snapshot, and a workspace that was deleted after the snapshot.
In scope: one workspace reads another's notes, a key or note body is in our logs, the note page loads a remote resource or runs markup, a folder key reads or writes outside its folder, or redact or block mode stores a known secret.
Version 1 does not include file attachments, client-side encryption, Google sign-in, live payments, teams, webhooks, model-written summaries, or more than one region.