0.195.1: liability note now covers security failure, not just data loss

README.md

@@ -137,9 +137,11 @@ and out of the way when you don't:
 > interrupted lock/unlock, or a sync writing the vault mid-operation can damage
 > encrypted files even when your password is perfectly safe. Keep unencrypted backups.
 >
-> *Stashpad cannot recover keys or passwords, and is not liable for the loss of keys,
-> passwords, or any data — whether the cause is a lost key or a fault in this beta
-> encryption itself.*
+> *No warranty of any kind. This encryption has never been audited, so it is not proven
+> to protect anything. Stashpad cannot recover keys or passwords, and is not liable for
+> the loss of keys, passwords or data, for a fault in this beta encryption, or for any
+> harm that follows if it fails to keep your data private. Keeping your own backups —
+> and deciding what is safe to trust it with — are yours to do.*
 
 ## Feedback
 

manifest.json

@@ -1,7 +1,7 @@
 {
 	"id": "stashpad",
 	"name": "Stashpad",
-	"version": "0.195.0",
+	"version": "0.195.1",
 	"minAppVersion": "1.13.0",
 	"description": "A chat-style, nested-notes workspace: rapid capture, outliner navigation, fast search, tasks, and per-folder templates, with one-click Open Knowledge Format (OKF) export for LLMs and agents.",
 	"author": "Human",

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "stashpad-obsidian",
-	"version": "0.195.0",
+	"version": "0.195.1",
 	"private": true,
 	"scripts": {
 		"dev": "node esbuild.config.mjs",

release-notes/0.195.1.md

@@ -0,0 +1,16 @@
+# 0.195.1
+
+## Encryption warnings
+
+- The liability note now covers the **security** outcome as well as data loss. It
+  previously disclaimed losing your keys or data, but said nothing about what happens
+  if the encryption simply fails to protect something:
+
+  > *No warranty of any kind. This encryption has never been audited, so it is not
+  > proven to protect anything. Stashpad cannot recover keys or passwords, and is not
+  > liable for the loss of keys, passwords or data, for a fault in this beta
+  > encryption, or for any harm that follows if it fails to keep your data private.
+  > Keeping your own backups — and deciding what is safe to trust it with — are yours
+  > to do.*
+
+  It appears in Settings, on every password dialog, and in the README.

src/modals.ts

@@ -1855,7 +1855,7 @@ export class EncryptionPasswordModal extends Modal {
     // the key is safe, so the risk + liability travel with every password dialog.
     const betaRow = this.contentEl.createDiv({ cls: "stashpad-beta-row" });
     betaRow.createEl("span", { cls: "stashpad-beta-badge", text: "BETA" });
-    betaRow.createEl("span", { cls: "stashpad-beta-note", text: "Beta encryption — data can be lost with or without your key. Keep unencrypted backups; Stashpad isn't liable for data loss." });
+    betaRow.createEl("span", { cls: "stashpad-beta-note", text: "Beta, unaudited encryption — not proven to protect anything, and data can be lost with or without your key. Keep unencrypted backups. Stashpad isn't liable for data loss or for a failure to keep your data private." });
 
     if (this.opts.intro) {
       this.contentEl.createEl("p", { cls: "stashpad-export-desc", text: this.opts.intro });

src/settings.ts

@@ -1691,7 +1691,7 @@ export class StashpadSettingTab extends PluginSettingTab {
         "Each device unlocks with its own password (it never leaves the device); collaborators get access by device approval, not a shared password. If everyone with access loses their password, the content is unrecoverable. While encrypting or decrypting, avoid having a sync/cloud service write the vault mid-operation — it can corrupt files.",
       );
       warn.createEl("p", { cls: "stashpad-enc-liability" }).setText(
-        "Stashpad cannot recover keys or passwords, and is not liable for the loss of keys, passwords, or any data — whether the cause is a lost key or a fault in this beta encryption itself. Keeping your own backups is yours to do.",
+        "No warranty of any kind. This encryption has never been audited, so it is not proven to protect anything. Stashpad cannot recover keys or passwords, and is not liable for the loss of keys, passwords or data, for a fault in this beta encryption, or for any harm that follows if it fails to keep your data private. Keeping your own backups — and deciding what is safe to trust it with — are yours to do.",
       );
 
       // 0.137.4: ONE collapsible, toggle-free "how it works" reference block, so