Add CloakBin in Pastebins#420
Conversation
Adds a new Pastebins category under Productivity with two entries: - CloakBin: open-source zero-knowledge encrypted pastebin (AES-256-GCM, client-side encryption, key in URL fragment) - PrivateBin: self-hosted zero-knowledge pastebin (256-bit AES) Disclosure: I am the developer of CloakBin.
|
Hello @Ishannaik Thank you for contributing to Awesome Privacy! We will review your submission shortly. In the meantime, please ensure all changes are correct and inline with our Contributing Requirements. Our automated checks detected some issues:
Note I am a bot, and sometimes make mistakes in my suggestions. But a human will review your submission shortly! Summary of Changes:
Submission InfoWebsite Checks
Repo Stats
The above data does not determine a submissions eligibility. Human review is still needed. For full details, please see workflow run 22987332806 UpdatesEdit 1: - 1 issue was resolved, but 3 checks are still failing, see here for details |
Ishannaik
changed the title
Adds a new Pastebins subsection under Productivity with CloakBin, an open-source zero-knowledge encrypted pastebin. Disclosure: I am the developer of CloakBin.
lissy93
left a comment
lissy93
left a comment
There was a problem hiding this comment.
Hey @Ishannaik
Thanks for your PR! CloakBin looks really cool.
But I did try out the app, and took a quick look at it's code. And I don't think it's quite at the level needed to be listed here. Especially in terms of privacy and security.
In the Listing Requirements section of the contributing guides, we say that a project needs to be at least 4 months since first release, Actively maintained, Functional, Mature and not entirely vibe coded.
It's very common for projects which don't meet these requirements to have issues very similar to those seen identified in CloakBin, and that's why we put those requirements in place.
Feel free to re-submit once requirements met, and issues resolved
|
Update: The contact form not working and security.txt is not present 😔 I hope this won't come accross as too negative. I do think that CloakBin is a cool app, it's just still in the early stages, and needs a human to proof-read the AI-generated code. Summary: 8 security suggestions, 4 privacy issues, and 4 requirements for listing not met. SecurityCache Poisons
|
Fixes 5 security issues identified by @lissy93 in lissy93/awesome-privacy#420 1. Admin session forgery (CWE-565): Replace base64(user:timestamp) tokens with HMAC-SHA256 signed tokens using crypto.timingSafeEqual 2. Burn after read broken (CWE-367): New atomic POST /api/paste/[id]/burn endpoint using MongoDB findOneAndDelete — paste content returned only once, deleted in same operation 3. Unauthenticated DELETE (CWE-862): Removed public DELETE handler entirely. Deletion now only via burn endpoint, expiry, or admin 4. Admin __data.json exposure (CWE-284): Added auth guards to all admin load functions and form actions before any DB queries 5. Cache poisoning: Added Cache-Control: private, no-store to paste API GET responses Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes 5 security issues identified by @lissy93 in lissy93/awesome-privacy#420 1. Admin session forgery (CWE-565): Replace base64(user:timestamp) tokens with HMAC-SHA256 signed tokens using crypto.timingSafeEqual 2. Burn after read broken (CWE-367): New atomic POST /api/paste/[id]/burn endpoint using MongoDB findOneAndDelete — paste content returned only once, deleted in same operation 3. Unauthenticated DELETE (CWE-862): Removed public DELETE handler entirely. Deletion now only via burn endpoint, expiry, or admin 4. Admin __data.json exposure (CWE-284): Added auth guards to all admin load functions and form actions before any DB queries 5. Cache poisoning: Added Cache-Control: private, no-store to paste API GET responses
|
Hey @lissy93 thank you so much for this incredibly thorough review. This is the most detailed and well-documented security feedback I've received, complete with CWE references and reproduction steps. I really appreciate you taking the time. Quick request: Would you mind editing out the specific data points from your comment (email addresses, revenue, figures, user counts, database stats)? That data was exposed through the __data.json vulnerability you identified which is now fixed but it's still visible here. Some context: CloakBin is my first SaaS project been building it solo for about 3-4 months, mainly to learn SvelteKit and modern web security. Your review was a wake-up call and I treated it as a priority. Every single issue has been addressed. Security (8/8 fixed)
Privacy (3/3 addressed)
Other:
Commit: Ishannaik/CloakBin@966824c On the zero-knowledge design Something I'd love your perspective on CloakBin follows the same philosophy as https://paste.parinux.org/faq/: ▎ "0bin is not built to protect user data but rather the host. The host has plausible deniability as they cannot Even if every vulnerability you found was exploited simultaneously, no attacker could read a single paste. The On the open-source vs hosted difference — the hosted version (cloakbin.com) has a few additional premium features (Stripe billing, custom URLs, API keys), but the core encryption and paste engine is the same codebase. The premium features will gradually be ported to the open-source repo. Think of it like GitLab CE vs EE, same core, extra features for the hosted service to cover hosting costs. Gave you a follow, thanks again for the review. |
|
Heya,
Oops, I'm sorry for including that data - when I wrote this up, I intended to email it, and then forgot to edit it out before sharing here 😳 Also, when I tried the app, I did so in a VM which has now been destroyed, so rest assured I do not have a copy of any of the data.
And it's a really good project! Svelte + SvelteKit are my fave stacks for building apps like this too. Keep building 🫡
Very true - your encryption logic is solid 💪
If it helps, a lot of my apps have a similar approach of being open source, but then also having a SaaS version. The way I do it, is just a single codebase (everything is public) but then configure features via env vars. And yes - that does mean that self-hosted users can use premium features for "free". But if they're self-hosting, they're probably not the type of user who was going to pay for the product anyway. Paying customers are paying for the convenience, not the code. And (at least for me), I think that helps the projects grow, since more contributors and users overall. Even if I did loose out on one or two paying customers, having million+ downloads can be more valuable in the long-run (and leads to other revenue sources, like corporate sponsors). A different approach, would be one like ag-grid's. Again they have everything public, but then they have a licence which requires payment to use any of the premium code. And this seems to work really well for them. |
FYI @lissy93, I can still see the redacted pieces of information from this comment #420 (comment) via the comment edit history. To completely remove it you also have to delete the revision of the comment as described here. |
|
Thank you @PythonGermany - done |
Hey @lissy93, that's genuinely reassuring to hear. Hope to keep learning, and honestly brutal reviews like this one do more for growth than any course or tutorial ever could. On the codebase splitThe main reason I kept them separate was to keep the self-hosted version small and auditable. For a privacy tool, On the ag-grid modelThis is something I genuinely hadn't considered before. Keeping everything public but licence-gating premium features
Going to study how they structure it and see how it fits as CloakBin matures. I am really grateful you went this deep instead of just closing the PR. One quick question, when would be a good time to |
|
No problem :) Btw, there's a new dedicated section for paste bins/secret sharing now (added in #456) - so it will fit in nicley there :)
As a high-level guideline, when all these requirements are met. As an example, the other two paste bin apps listed serve as a good example. They're simple to use, reliable, easily auditable code, well battle-tested, and generally well written and secured. |
4 participants
Type
Addition
Changes
Adds a new Pastebins subsection under Productivity with CloakBin — an open-source zero-knowledge encrypted pastebin with client-side AES-256-GCM encryption. The decryption key stays in the URL fragment (#key), never sent to the server.
Supporting Material
Affiliation
I am the developer of CloakBin.
Checklist