Security posture

Papyra is self-hosted software holding people’s private writing. This page says plainly what it does and does not do, so you can decide how to run it.

Accounts and sessions

• Passwords are hashed with BCrypt.
• Sign-in is throttled per account — ten attempts per fifteen minutes — and the auth endpoints are additionally rate-limited per IP.
• Sessions are cookie-based: HttpOnly, SameSite=Lax, and Secure in production unless you explicitly turn that off for a private network.
• The signing keys live on the data volume, so restarting or upgrading the container does not silently sign everybody out.
• An account created or reset by an administrator must set its own password before the API will do anything else for it.

Isolation between accounts

Each account’s notes live in their own directory, and every path the API resolves is checked against that directory before any read or write. A crafted note id cannot walk out into another account’s vault; the request is refused.

This is enforced in the storage layer rather than by filtering results, so it holds on code paths nobody thought about specifically. Personal access tokens inherit the same boundary as the account that made them.

Administrators can manage accounts but cannot read other people’s notes — there is no screen for it because there is no code path that would produce one.

Vault notes

A note marked secure has its body withheld by the server. The API returns metadata and an empty body until a passkey unlock issues a short-lived token, which the server checks before sending any text.

The blur in the UI is cosmetic. The lock is that the bytes were never sent.

Vault notes are never shareable and never deliver a mention.

Tokens and secrets

• Personal access tokens are stored hashed and shown once, at creation.
• API keys for OpenAI/Anthropic and the SMTP password are write-only over the API: the server reports whether one is set, never its value.
• Outbound webhooks are HMAC-signed so the receiver can verify the delivery came from your instance.

Transport and headers

Security headers and a Content-Security-Policy are set on every response. Forwarded headers are only trusted from proxies you have explicitly listed, so an unlisted proxy cannot spoof a client address past the rate limiter.

What Papyra does not claim

• Notes are not encrypted at rest. They are plain files on your disk, which is the entire point of the design. Use full-disk encryption if you need it. Encrypted backups are a separate, supported thing.
• Vault notes are access-controlled, not encrypted. The server withholds them; it does not encrypt them on disk. Someone with your disk has them.
• No third-party audit has been performed.
• This is young software, under active development, and the project says so on its own front page.

The developer portal is reachable in production

Your instance serves live API documentation at /docs, deliberately, so self-hosters have real documentation for their own server. It documents the same authenticated endpoints and grants nothing — the reader supplies their own personal access token to try anything.

Reporting a problem

Report security issues privately through GitHub’s security advisories rather than opening a public issue.

Papyra is GPL-3.0. All of the above is claims you can check against the source rather than take on trust.