Safer, and you won't notice

By Hafiz

Notes are personal. A shopping list sits next to a half-formed idea, next to something you'd never say out loud. So the place you keep them should be careful on your behalf, even when you're not thinking about it.

/CMD-Note runs in your browser, and a browser does what the page tells it to. That's what makes web apps so easy to open anywhere. It's also why I wanted /CMD-Note to be strict about two things.

First, how you reach it. /CMD-Note now tells your browser to always use a secure connection, every time, with no way to quietly fall back to a weaker one.

Second, what it's allowed to run. The browser now only runs code that /CMD-Note itself put on the page for that visit. Anything else gets refused, even if it somehow slipped in.

What you'll notice is nothing. Same commands, same animations, same speed, and it still opens offline. I checked that before shipping, because a security change that breaks the app you love isn't much of an improvement.

Most good security work is like that. You don't see it. You just get to keep trusting the thing.