site: security & privacy as the bold design vision (committed goals, not shipped guarantees) #26

New Issue

2026-07-28T15:48:27Z

KofTwentyTwo commented

2026-07-28 15:48:27 +00:00

(Migrated from github.com)

Context & goal

src/app/security/page.tsx and src/app/privacy/page.tsx should present the security & privacy VISION boldly — it's central to the north star (sovereign, local-first, encrypted at rest, OS keyring, cryptographic WORM audit). Apply guardrail: design goals we're building, not shipped guarantees stated as fact.

Requirements

Present the security/privacy model as the vision and design intent, compellingly.
Guardrail 2/3: phrase unshipped protections (at-rest body encryption, key zeroization, fail-closed updater, HTML sanitization, egress/bind hardening) as what Nuncio is built to do / the design goal rather than a delivered guarantee an auditor could verify today. Keep it consistent with the engine's direction (roadmap M6) and keep the vulnerability-reporting policy.
Avoid absolute "we encrypt everything / zero telemetry" claims stated as present fact unless genuinely true today; frame as the committed design.

Acceptance criteria

Security/privacy vision presented boldly as design intent, not as delivered-and-verifiable guarantees.
Consistent with the repo direction; reporting policy present.
Build + lint pass.

Size: M.

Governing philosophy — north star. This site sells the vision: what Nuncio will be. Present it boldly and aspirationally, as the destination we're building toward — do not water it down to "here's a broken pre-alpha." Only three hard guardrails apply:

Not available today. No "Download"/"Latest Release"/"install now". CTAs are "Notify me at launch", "Follow the build → GitHub", "See the roadmap →" (https://koftwentytwo.github.io/nuncio/roadmap/).
No invented data as real. Benchmarks must be genuinely measured (cite the source) or omitted — no "<10ms across 100,000+ emails" as if proven. UI mockups/renders are encouraged, but framed as product previews of the vision, not screenshots of a real running inbox with real people.
Status discoverable. A tasteful, consistent signal that this is in active development, plus a roadmap link, so a visitor understands it's what's coming and can see where we actually are.

Process: branch story/<slug> off the site's default branch; PR back; the PO reviews for vision quality AND the three guardrails before merge. npm run build + npm run lint must pass.

## Context & goal `src/app/security/page.tsx` and `src/app/privacy/page.tsx` should present the security & privacy VISION boldly — it's central to the north star (sovereign, local-first, encrypted at rest, OS keyring, cryptographic WORM audit). Apply guardrail: design goals we're building, not shipped guarantees stated as fact. ## Requirements - Present the security/privacy model as the vision and design intent, compellingly. - **Guardrail 2/3:** phrase unshipped protections (at-rest body encryption, key zeroization, fail-closed updater, HTML sanitization, egress/bind hardening) as **what Nuncio is built to do / the design goal** rather than a delivered guarantee an auditor could verify today. Keep it consistent with the engine's direction (roadmap M6) and keep the vulnerability-reporting policy. - Avoid absolute "we encrypt everything / zero telemetry" claims stated as present fact unless genuinely true today; frame as the committed design. ## Acceptance criteria - [ ] Security/privacy vision presented boldly as design intent, not as delivered-and-verifiable guarantees. - [ ] Consistent with the repo direction; reporting policy present. - [ ] Build + lint pass. Size: M. --- **Governing philosophy — north star.** This site sells the *vision*: what Nuncio *will be*. Present it boldly and aspirationally, as the destination we're building toward — do not water it down to "here's a broken pre-alpha." Only three hard guardrails apply: 1. **Not available today.** No "Download"/"Latest Release"/"install now". CTAs are "Notify me at launch", "Follow the build → GitHub", "See the roadmap →" (https://koftwentytwo.github.io/nuncio/roadmap/). 2. **No invented data as real.** Benchmarks must be genuinely measured (cite the source) or omitted — no "<10ms across 100,000+ emails" as if proven. UI mockups/renders are encouraged, but framed as **product previews of the vision**, not screenshots of a real running inbox with real people. 3. **Status discoverable.** A tasteful, consistent signal that this is in active development, plus a roadmap link, so a visitor understands it's what's coming and can see where we actually are. **Process:** branch `story/<slug>` off the site's default branch; PR back; the PO reviews for vision quality AND the three guardrails before merge. `npm run build` + `npm run lint` must pass.

KofTwentyTwo commented

2026-07-29 14:42:38 +00:00

(Migrated from github.com)

Implemented and merged in PR #30 (north-star relaunch, commit f567d9b).

Implemented and merged in PR #30 (north-star relaunch, commit f567d9b).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio-website#26