Bulbul: Private Code Spaces

Response from developer

Thank you for the thoughtful feedback. You’re asking exactly the right question, and I want to be transparent about how the app currently protects your files. Today, the app uses two main layers of protection. First, all files are stored inside the app’s private container and protected by iOS Data Protection, which uses hardware-backed encryption for data stored on the device. Second, passcodes are used to keep spaces isolated from each other. Your passcode is never stored on the device or in iCloud, and the app cannot reveal or recover it. A passcode only opens its own space and cannot access files from another space. To be fully transparent, file contents are not yet re-encrypted with a key derived directly from your passcode. At the moment, the passcode provides access control and space isolation on top of iOS’s built-in at-rest encryption. I’m actively working on adding passcode-derived file encryption as an additional layer, so files will be cryptographically tied to the passcode itself. I really appreciate you holding the app to a high security standard — that’s exactly the right expectation for an app handling sensitive files.