Skip to content

v1.0.0 — Initial Release

Choose a tag to compare

View all tags
@Ishannaik Ishannaik released this 16 Mar 04:45
· 90 commits to main since this release
v1.0.0
03e33b2

CloakBin v1.0.0

Zero-knowledge encrypted pastebin. Server only sees ciphertext. Key stays in URL fragment (#key).

Features

  • AES-256-GCM client-side encryption (key never leaves your browser)
  • Burn after read — atomic one-time viewing with findOneAndDelete
  • Password protection — PBKDF2 with 100k iterations
  • Syntax highlighting — 50+ languages with auto-detection
  • Custom expiry — 30 min to never
  • Admin panel — paste moderation, user management, analytics
  • Self-hostable — SvelteKit + MongoDB, deploy anywhere

Security

This release addresses all findings from a community security review:

  • HMAC-SHA256 signed admin sessions (replaces base64 tokens)
  • Atomic burn-after-read endpoint (prevents race conditions)
  • Auth guards on all admin routes (prevents __data.json exposure)
  • Public DELETE handler removed (deletion via burn/expiry/admin only)
  • Cache-Control: private, no-store on paste API

Tech Stack

  • SvelteKit 2 + Svelte 5
  • MongoDB + Mongoose
  • Tailwind CSS 4
  • CodeMirror 6

Self-Hosting

git clone https://github.com/Ishannaik/CloakBin.git
cd CloakBin
cp .env.example .env  # Configure your env vars
pnpm install
pnpm dev

See README for full setup instructions.

Assets 2
Loading