What problem does it solve? Products claiming client-side encryption, E2EE, or zero knowledge can silently leak protected plaintext through serializers, sync queues, logs, telemetry, or local storage. This Skill traces each user-content flow to verify encryption actually happens before data crosses the client boundary. ## Core Features & Use Cases - Boundary Order Tracing: Follows protected fields from plaintext source through encryption, serialization, and submission points with file and line evidence. - Plaintext Sink Detection: Searches logs, telemetry, local databases, caches, search indexes, queues, and third-party SDKs for unencrypted protected content. - Structured Findings: Produces severity-graded findings (CLIENT-ENC-001 style) using a JSON schema and a report template with flow boundary matrices. - Use Case: While reviewing an encrypted notes app, trace the autosave and background sync paths and discover the offline queue persists plaintext before encrypting at send time, reported as a high-severity finding with retest steps. ## Quick Start Audit this repository's create, edit, and sync flows to verify protected note content is encrypted before it reaches serializers, upload clients, local storage, logs, or telemetry, and report findings with file locations.
