Changelog

One-shot is real: after a note is read, a second request no longer returns ciphertext to the same browser for a few seconds

Rate limits on preview and consume — applied before storage, so flooding cannot burn a view

Preview and note responses no longer tell the client whether a note has a decoy

Homepage copy matches the locale: no leftover English on the Russian UI, no leftover Russian on English chrome

Password is a real second factor: the derived AES key is no longer shown or placed in the URL. The link without the password cannot be decrypted.

Split link vs one link — choose whether to send the key separately or keep it after # in the same URL

Copy all — link and key in one clipboard, with a reminder to send the key in a separate message

Custom TTL — any duration from 1 minute to 7 days, not only the four presets

Preview no longer reports a key as present when the URL hash is empty

Self-Destruct Mode — set a timer (30s / 1min / 2min) and the recipient sees a countdown before the secret is automatically deleted

Wall of Supporters — top-5 project supporters displayed on the support page

Ko-fi support — you can now support the project via ko-fi.com/secure_link

Visual confirmation on Status Page — sender sees that the secret was successfully delivered

Mobile optimization — input form on homepage is now visible immediately without scrolling

Server-side validation for self-destruct timer: allowed values check and TTL compliance

Improved accessibility: animations disabled for users with 'reduced motion' preference

Warning when closing the page if the secret hasn't been copied yet

Live Privacy Proof — real-time encryption visualization (AES-256-GCM)

Support page — transparent info on donations

Decoy Mode highlighted on homepage with tooltip

Secrets counter, onboarding hints, haptic feedback

WCAG AA accessibility, 320px screen optimization

🔥 Burn on Failure — every password attempt (correct, wrong, or decoy) decreases the view counter. Attacker cannot tell which password was entered.

📜 Destruction Certificate (Proof of Destruction) — visual confirmation of note deletion with timestamp, Reference ID, and reason. Downloadable as PNG.

🛡️ 'Emergency Destruction' status — when password attempts are exhausted, note is destroyed with a clear status instead of generic 'viewed'

Improved password input screen: shows remaining views from server, adaptive colors (blue → yellow → red)

Removed client-side attempt blocking — server now controls limits via views

🛡️ Decoy Mode — plausible deniability. Two passwords: real and fake. Under duress, enter the fake one — shows decoy text, note is destroyed.

Brute-force protection: minimum 3 views for Decoy Mode (each password attempt consumes a view)

Added Decoy Mode instructions to 'How it works' page

Trust indicator in header — green shield 🛡️ shows zero-knowledge status

Improved result UI: shows expiry date instead of anxiety-inducing countdown timer

Share button now uses native Web Share API on mobile devices

Redesigned mobile interface: primary action button, copy feedback states

Fixed auto-deleted notes counting in statistics

Replaced warning badge with informative split-link hint

Simplified link usage: # added automatically

Added privacy-friendly analytics (Vercel Analytics)

Added auto-deletion tracking to statistics

Fixed critical bug with long texts (React Error #185)

Improved 'How it works' page with shorter guide

Added usage statistics

Improved security: updated CSP headers

Encryption performance optimization

First version of threat model

Security documentation

Responsible disclosure policy