[ TECHNICAL ]
Security
Technical overview of Bunorden's security architecture
Security Model
Bunorden uses a zero-knowledge architecture where all sensitive data is encrypted on the client before transmission. Our servers store encrypted data but cannot decrypt it.
Core principle: If we can't read it, we can't leak it, lose it, or be compelled to hand it over.
Encryption Implementation
Key Derivation
Algorithm: Argon2id
Memory cost: 64 MB
Time cost: 3 iterations
Parallelism: 4 threads
Data Encryption
Algorithm: AES-256-GCM
Key size: 256 bits
IV: Randomly generated per encryption
Authentication: Built into GCM mode
Threat Model
What We Protect Against
- Server-side data breaches (data is encrypted)
- Network eavesdropping (TLS encryption)
- Unauthorized server access (we can't decrypt user data)
- Password guessing attacks (Argon2id resistance)
Known Limitations
- Client-side malware can capture data before encryption
- Compromised devices may expose encryption keys
- Password loss results in permanent data loss
- Metadata (timestamps, data sizes) is not encrypted
Responsible Disclosure
Found a security vulnerability? We appreciate responsible disclosure.
Email: security@bunorden.com
Response time: Within 24 hours
Bounty: We currently don't offer monetary rewards but will credit researchers who report valid issues.