CLEAR BOUNDARIES. CAREFUL DEFAULTS.
Security, with evidence.
THE SHORT ANSWER
Chevlume limits what this version collects: the community preview keeps your writing in page memory, uses no analytics or cookies and has no connected accounts. Security controls are tested and documented, but no system can promise absolute protection. A connected community requires further review before real user data is accepted.
Your writing stays local
Profile edits, publications, replies and learning progress stay in the open page. They are not sent to a server. Closing or reloading the page clears them. The site does not store them in cookies, local storage or session storage. Hosting still involves the technical request data needed to deliver the site.
You choose what leaves the page
Copy and export controls act only when selected. A workspace export contains your writing and profile in an unencrypted file; review it and keep it private when appropriate. The contribution record includes a smaller, self-reported summary and leaves out reply bodies and your profile bio. Example discussion links contain no local replies or profile data.
Defence in depth
The static build uses self-hosted scripts, fonts and images. Its configured Content Security Policy blocks network connections from the community module, inline executable scripts, framing and native form submission. Text entered into the preview is rendered as text. Workspace imports are restricted by size, structure, identifiers and validation rules.
The deployed response headers and account configuration must be checked on the actual host. A source file or an automated test is not proof that every hosting setting has been applied.
Before connected accounts open
Registration, authentication, shared storage, public uploads and live collaboration are not connected in this version. They must be built with server-side access controls, privacy choices, secure session handling, reporting, moderation, removal and recovery processes, then tested before accepting real user data.
Report a security concern
Contact @chevlume to request a private reporting channel. Do not post passwords, personal data, confidential files or exploit details publicly. We do not claim a paid bug bounty or a response-time guarantee.