What problem does it solve? Products that claim end-to-end encryption or zero-knowledge architecture may still expose user plaintext through server-side stores, logs, queues, admin tools, or KMS decrypt paths. This Skill systematically audits whether a backend, operator, or support workflow can recover user plaintext or key material, validating or challenging privacy claims with concrete evidence. ## Core Features & Use Cases - Plaintext Path Tracing: Follows protected data through validation, serialization, encryption, persistence, indexing, notifications, logging, export, and retention across databases, object storage, queues, and observability systems. - Decrypt and Key-Unwrap Auditing: Identifies KMS/HSM decrypt calls, envelope encryption helpers, escrow keys, break-glass flows, and admin tools that let the server recover plaintext or keys. - Sentinel-Based Testing: Uses synthetic sentinel values to search server-side stores for direct, encoded, and content-derived plaintext without touching real customer data. - Use Case: A security team reviewing a note-taking app that claims E2EE uses this Skill to discover that note titles and search snippets are stored unencrypted in the database and push notification payloads, producing severity-rated findings with remediation guidance. ## Quick Start Audit this repository's backend for any code paths, logs, queues, or admin tools where server-side components can access plaintext of content claimed to be end-to-end encrypted, and report findings with severity and evidence.
