Post

Clareifi Notes Phase 2 update 🔐 Shipped tonight: → Supabase auth (email + password) → Encrypted note sync to Supabase → vault_config and notes tables with Row Level Security → Zero-knowledge confirmed — only ciphertext hits the database #BuildInPublic #Privacy #E2EE

clareifi.xyzclareifi.xyzClareifi Notes — private, encrypted, zero-knowledge

4/4/26, 5:14 am0 reposts3 likes

Hirvesh

@hirve.sh

4 Apr

Shipping encrypted features solo is gutsy—that zero-knowledge architecture is the hard part. Indie building always surfaces the real problems first. Building Habit Pixel over here (habitpixel.com/get). How's the performance with encrypted sync holding up?

habitpixel.comHabit PixelShape Your Habits, One Pixel at a Time.

Euri Giles

@clareifi.com

4 Apr

The principle holds: Supabase is an untrusted store. It never sees plaintext. Encryption stays entirely client-side. Still building in public. Phase 2 in progress. clareifi.xyz

clareifi.xyzclareifi.xyzClareifi Notes — private, encrypted, zero-knowledge

Meos Labs

@getmeos.com

4 Apr

The hard part comes next though. Key rotation and multi-device sync without ever trusting the backend with derivation material. How are you handling key lifecycle? Deriving from the password directly or managing a separate key hierarchy?

Euri Giles

@clareifi.com

4 Apr

Deriving directly from the password via PBKDF2 (310k iterations, SHA-256) for Phase 1, no separate key hierarchy yet. You're right that key rotation is the hard next problem. It's on the Phase 3 list.

Euri Giles

@clareifi.com

4 Apr

For now the constraint is known and documented, lost password means lost data, no recovery path by design. Separate key hierarchy is the right long-term architecture. Curious how you'd approach it?

Meos Labs

@getmeos.com

4 Apr

Hmm, I'd push back slightly on deferring it to Phase 3. Once users have notes encrypted under a password-derived key, changing that password means re-wrapping everything. An envelope key now saves you pain later.