Stacks
Join the waitlist
Security
One database per library
Every library has its own SQLite database. One code path turns an account into a library, and a lint check fails the build if another path appears. Tests plant leaks on purpose and fail if they miss one.
Connections
An AI app connects with OAuth and PKCE, so it never holds a password or an API key. A token is tied to you and to that app. Remove an app and its token stops at once.
Saved text is data
A saved page or post can hold instructions meant for an AI. Stacks strips hidden characters and markup, labels text that reads like an instruction, and tells the AI in every result that saved text is data. A label cannot stop an AI that chooses to obey. A hijacked AI can read your library and add items. It cannot read another library.
Images and links
Image links are signed and expire within 1 hour. When Stacks fetches a saved link, it refuses private and internal addresses, checks every redirect, and caps size and time.
Imports
Stacks treats an import file as hostile. It refuses ZIP bombs, bad file names and wrong checksums, and an import never overwrites.
Sign-in
You sign in with a passkey. There is no password to steal. Sign-up needs an invite while the beta is closed.
Not done yet
The isolation tests cover the store and the AI connector. A few isolation cases for web routes, the account database and the extension are still marked to do. People who run Stacks can reach storage by deploying code. Nothing here is audited by an outside firm.