how are you handling the encryption keys? is it encrypted client-side before upload or handled on the backend?
basically, if your db gets breached can someone access my decrypted files?
basically, if your db gets breached can someone access my decrypted files?
When you start an upload, the API generates a unique bID and secret, then provides a short-lived presigned URL. Your file transfers directly from your terminal to S3—it never passes through our servers. Once the upload completes, the bID and secret are returned to your CLI.
The secret is immediately discarded by our backend. Only its cryptographic hash is stored in our database.
I've been actively working on adding client-side encryption to the CLI so files are encrypted by the binary before upload. The CLI implementation is ready, but I'm working through aligning the web dashboard with these changes. Should have it deployed in the next few days.