Blog: last three Main Blogs (passwords in notes, encryption vs privacy, switching apps)

[DevBehindYou]

The last three Main Blogs from the Rank One plan: S3, S4, and S5. With this PR, all 15 Main Blogs are written.

The posts

ID	Slug	Primary keyword	Words*	Widgets
S3	storing-passwords-in-notes-app	storing passwords in notes app	1,840	blast-radius, secret-scanner
S4	encrypted-notes-privacy	how does encryption protect privacy	1,832	threat-matrix, key-custody
S5	switch-notes-app	switch notes app	1,824	switch-check, count-check

* Visible prose, not counting code or Sources.

Each post has a banner, 5 figures, a quick answer, an FAQ, "Keep reading" links, an ink CTA, and Sources. Keywords come only from keyword-registry.json. Facts were checked on October 9, 2026. The launch gate still applies, so no CTA says "download and sign in".

Honest details worth knowing

• S3 never presents Atomic Notes as a password manager. It says plainly that the vault is for private writing, not for credentials.
  • The breach-check command uses the Pwned Passwords range API. Only a 5-character hash prefix leaves the computer. It was tested with a dummy password.
  • The Verizon 2025 DBIR figure (credential abuse 22%) comes from Verizon's own announcement.
• S4 uses Apple's published data as the worked example:
  • which metadata stays visible even with Advanced Data Protection;
  • that ADP is no longer offered to new UK users (February 2025), which shows that key custody can be a legal question.
  • It also cites the LastPass 2022 notice, where website URLs were unencrypted.
• S5 says plainly that Atomic Notes has no import tool and no export button yet.
  • It includes a short Python script that turns the .atomic files from the user's Drive into Markdown. The script skips vault notes and handles both item formats (text/done and t/d). I tested it on sample files.
  • The export facts were checked on each provider's help page: Evernote (desktop only, up to 100 notes at a time), Notion, Apple Notes Markdown export (iOS 26), and Google Takeout. The Pocket shutdown dates come from Mozilla's support page.
• secret-scanner works only in the browser. It masks what it finds and is labeled as pattern matching, not proof. It flagged a card line as a backup code during testing; that was fixed, and the scanner was re-tested.

Other changes

• P3's "I'll cover this one in depth in a separate guide" now links to S3.
• Five live posts get one more "Keep reading" link each.
• llms.txt lists the 3 new posts.
• The uncommitted Rank One files and the package.json scripts are not in this PR.

Checks

• validate.mjs: 16/16 posts pass, checked on LF copies.
• cluster-check.mjs: passes. --draft passes for all 3 new posts, and --overlap passes.
• npm audit --audit-level=high: passes.
• tsc and next build: pass, with 16 blog paths.
• test:smoke: 24/24 pass.
• Browser check on a local production build, at 390 px and at desktop width:
  • all figures return 200;
  • every widget button was clicked through;
  • no element overflows the page;
  • the count checker flags a gap correctly;
  • the scanner flags all 6 kinds of fake secrets in its sample correctly.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
atomic-notes-community	Ready	Preview	Oct 9, 2026 5:46pm UTC