# Increment 40 security notes

## Implemented controls

- AES-256-GCM authenticated encryption for file bodies.
- AES-GCM authenticated encryption for extracted text, ZIP inventory and warning metadata.
- Per-artifact random nonces and contextual additional authenticated data containing file identity, digest and key version.
- New uploads fail closed when `KIMU_MASTER_KEY` is missing or invalid.
- Installer generates a random 32-byte master key and restricts `.env` permissions.
- Legacy plaintext migration is serialised with an inter-process lock.
- Authorised downloads decrypt as a stream and never create a persistent plaintext copy.
- Optimistic versions prevent silent overwrites for conversations, model preferences and owner settings.
- Stable client operation IDs prevent duplicate chat creation after an ambiguous reconnect.

## Plaintext metadata retained by design

SQLite retains original filename, MIME type, clear size, SHA-256, file kind, state and timestamps. This supports indexing, validation, attachment selection and correct download headers. It can disclose filenames and file characteristics to anyone with database access.

## Browser storage boundary

IndexedDB drafts and queued JSON mutations are not encrypted by KIMU. They inherit the browser profile and operating-system storage protections. Shared-device users must use a separate trusted browser profile and sign out when finished.

## Key handling

Loss of `KIMU_MASTER_KEY` makes encrypted bodies and private metadata unrecoverable. Replacing the key without re-encrypting existing data will cause authentication failures. Increment 40 records key versions but does not implement automatic rotation.

## Remaining security work

- Offline authentication vault and app-level IndexedDB encryption.
- Key rotation/re-encryption workflow.
- Backup/restore with encrypted key-handling guidance.
- External penetration testing and browser/device acceptance evidence.
- Restart-resilient job ownership and recovery.