Security model

Trust model in one sentence

FLOWX is a server-trusted messaging service: your messages are encrypted in transit and at rest, but the FLOWX service holds the decryption keys and can read message content in order to deliver it, enforce expiry, and power search.

FLOWX is not end-to-end encrypted. If someone gains control of the running service and its keys, they could read messages. We will only describe FLOWX as end-to-end encrypted once a reviewed protocol with per-device keys is implemented and audited.

In transit

• All production traffic uses HTTPS, with HTTP Strict Transport Security.
• Realtime connections use secure WebSockets. Realtime events carry identifiers only — message text and file names are fetched separately through the authorized API.
• Secrets are never placed in URLs. File downloads use signed links that expire after five minutes.

At rest

• Message bodies, vault snapshots, and vault notes are encrypted with AES-256-GCM before they reach the database. Each ciphertext is bound to its record, so it cannot be moved to another message.
• Encryption keys are stored as deployment secrets, separately from the database, and are versioned so they can be rotated.
• The database and file storage providers add their own encryption at rest.
• Metadata — who is in which conversation, timestamps, file names and sizes, reactions — is not application-encrypted.

Search

Message search uses a keyed-hash index: each word is stored as an HMAC rather than as text. Someone with only database access cannot read words from the index, though they could tell when two messages share a word. Search results are always filtered to conversations you can currently access, and entries are removed when a message is edited, deleted, or expires.

Accounts and sessions

• Sign-in uses Discord OAuth 2.0 with the “identify” scope, PKCE, and a signed state value to prevent login forgery. The Discord access token is revoked immediately after your profile is read.
• Sessions are random tokens stored in HttpOnly, Secure, SameSite cookies. Only a hash of each token is stored server-side, and you can revoke any session from Settings.
• State-changing requests must come from the FLOWX origin.

Disappearing messages

• Each message stores an authoritative expiry time. Expired messages are excluded from every API response immediately, even before cleanup runs.
• A scheduled job permanently deletes expired messages, their reactions, search entries, and attached files in bounded batches.
• Database backups held by the hosting provider are retained on that provider’s schedule and are not rewritten when a message expires.
• Nothing can stop a recipient from taking a screenshot, photographing their screen, or copying text. Browsers cannot reliably block screenshots or screen recording, and FLOWX does not claim to.

Files

• Files are uploaded directly to private object storage. There are no permanent public links.
• File type is detected from the file’s contents, not from its name or the browser’s claim. Only common image, video, and audio types are shown inline; everything else is served as a download.
• Malware scanning is not yet performed. Treat files from people you don’t know with care.

Screen privacy

You can choose to blur the interface whenever the window loses focus. This is a best-effort courtesy against shoulder-surfing and app switchers; it is not screenshot protection.

Reporting a vulnerability

If you believe you have found a security issue, please contact the operators of this deployment privately before disclosing it publicly.