Blog: five more Main Blogs (local first apps, encrypted apps, offline Android, no AI, privacy mistakes)

[DevBehindYou]

Five more Main Blogs from the Rank One plan, in plan order: L2, S2, L4, P4, then P3. That makes 12 of 15 Main Blogs.

The posts

ID	Slug	Primary keyword	Words*	Widgets
L2	best-local-first-note-taking-apps	local first note taking apps	2,092	local-first-matcher, shutdown-test
S2	best-end-to-end-encrypted-notes-apps	best encrypted notes app	1,912	recovery-check, guess-time
L4	best-offline-notes-apps-android	best offline notes app android	2,056	offline-finder, permission-reader
P4	best-note-taking-apps-without-ai	note taking app without ai	1,898	ai-scanner, ai-path
P3	notes-app-privacy-mistakes	notes app security	1,956	habit-audit, apk-checker

* Visible prose, not counting code or Sources.

Every post has the following:

• A banner and 5 figures, 1,800 px wide, rendered with visuals/render.py.
• A quick-answer callout, a comparison table, and an FAQ.
• "Keep reading" links, an ink CTA, and a Sources section.
• Keywords taken only from keyword-registry.json.

The CTAs point to the home page or GitHub, never to "download and sign in", because the launch gate is still in place.

The lists

• Atomic Notes is first in every listicle and is disclosed as my app. The disclosure is worded differently in each post.
• Every competitor appears in only one list across all 12 posts. None of P2's apps is repeated.
• Every competitor fact was checked on October 9, 2026, using:
  • GitHub repositories and releases;
  • F-Droid listings and AndroidManifest.xml for permissions;
  • each app's own security docs;
  • changelogs.
• Each post records the date it was checked.

Honest, slightly awkward details

• S2 (Atomic Notes vault): Google Drive keeps old file versions for up to 30 days. A note that was plain text before the vault was switched on can stay in that file's version history until Drive drops it. The post says so and suggests turning the vault on early.
• S2 (audits): Atomic Notes, Notesnook, Cryptee, and Joplin have no published independent audit. Standard Notes has four. The post says this plainly, and no app is called "the most secure".
• P4 (Dynalist): it is in maintenance mode, a status its team confirmed in 2024. The post says so.
• L4 (sNotz): the GitHub release is 0.35 (July 2026), but F-Droid still lists 0.34 (August 2025). The post states both.
• P3: it shows the real sha256sum and apksigner commands, with the published 2.03.5 checksum and certificate. The apk-checker widget hashes a file in the browser with Web Crypto, and nothing is uploaded.

Other changes

• Seven live posts get one new "Keep reading" link each.
• P2's "separate guide" sentence now links to S2.
• public/llms.txt lists the five new posts.
• globals.css gets a small .bw-stop rule for the ai-path widget.
• The uncommitted Rank One files are not in this PR.

Checks

• validate.mjs: all 13 posts pass, checked on LF copies.
• cluster-check.mjs passes. --draft passes for all five posts, with no notes left against the old Medium drafts after the rewrites. --overlap passes.
• npm audit --audit-level=high passes. Five moderate advisories remain on next 15.5.24 and gray-matter's sprintf-js; neither is high.
• npx tsc --noEmit and npm run build pass. The build has 13 blog paths.
• npm run test:smoke: 24/24.
• Browser check on a local production build, at 390 px and desktop width, for all five posts:
  • every figure loads (200);
  • every widget renders, and every button in it was clicked through;
  • no element overflows the page;
  • the only console errors are the local /_vercel/insights 404s, which are expected.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
atomic-notes-community	Ready	Preview	Oct 9, 2026 2:44pm UTC