Security Limitations

1. Why this page exists

LocnLock encrypts your data well, and this page tells you plainly where that protection ends. No vault — local or cloud — protects against everything, and security claims are only trustworthy when the limits are published next to them. This statement matches the project's internal threat model; nothing here is softened.

2. Your master password is the real boundary

Anyone who copies your vault file or a backup can attack it offline, guessing passwords as fast as their hardware allows. Argon2 key derivation makes each guess expensive, but the strength of your master password is the true bound — a weak password is the dominant risk for a stolen vault file. The in-app delay after failed unlock attempts slows someone at your keyboard; it does nothing against a copied file, and it is deliberately a slowdown, not a permanent lockout.

3. A compromised device defeats any vault

If malware runs on your machine — a keylogger, screen capture, or a process reading memory while the vault is unlocked — it can capture your master password and any secret you view or copy. LocnLock protects data at rest and narrows exposure windows (masked values, auto-lock after inactivity, clipboard auto-clear); it cannot secure an operating system that is already compromised, and does not claim to.

4. Copied secrets touch the system clipboard

Copying a sensitive value places it on the system clipboard. LocnLock clears it automatically after a short window and immediately on lock, but during that window other applications — including clipboard-history managers — can read it.

5. Exports are plaintext on purpose

Exported .env files, saved Recovery Kit files, and exported secure files are written unencrypted — that is their job. The app warns at each of these moments, and from then on the file's confidentiality is in your hands: it is outside the vault's encryption entirely.

6. Some structure stays unencrypted by design

Record contents are encrypted, but operational metadata is not — among them: environment labels, the sensitive flag, display order, timestamps, record relationships, per-project feature settings, certificate flags, and stored file sizes. Someone holding your vault file can see its shape — roughly how many records exist and how they are organized — without being able to read any content. This is a deliberate trade-off, documented rather than hidden.

7. Recovery has no back door

There is no vendor reset: Rahman Mubarok never holds your master password, Recovery Key, or any copy of your vault. If you lose the master password, the Recovery Key saved at setup, and your backups, the data is unrecoverable by anyone — including the developer. That is the cost of a vault nobody else can open.

Backups are point-in-time snapshots: a backup made before you replaced your Recovery Key can still be opened and restored with the older key it was exported under. After replacing a Recovery Key, export a fresh backup and treat the old files accordingly.

8. One factor, one person

Access is protected by the master password (with the Recovery Key as the fallback). There is no second factor, hardware-key support, or duress mode, and LocnLock is a single-user application — it does not separate or audit multiple users on the same machine account.

9. Questions

Security reports are welcome — see the support page for the private reporting route. Questions about this statement may be sent to support@locnlock.com.