Privacy model

Research Workbench is designed for private data, but privacy depends on how you deploy and store the vault.

Boundaries

The public application repository contains no real vault.
The server reads only the directory configured by PM_VAULT_ROOT.
Markdown reads and writes are constrained to that directory.
Only Markdown files are editable.
Common private, import, database, dependency, and build directories are excluded from indexing.
Non-local API requests require PM_APP_TOKEN.
The unauthenticated health endpoint reports availability, not paths or file contents.
The browser stores the app token locally and sends it only to the configured origin.

private: true is a display filter, not encryption or access control.
The bearer token is not multi-user authentication.
The app does not encrypt the vault at rest.
The app cannot prevent a vault repository from being made public.
The privacy scanner catches common mistakes; it is not a proof that text is anonymous.

Keep the public application checkout separate from the vault.
Store the vault on an encrypted device or private persistent disk.
Use a long random PM_APP_TOKEN.
Put remote access behind TLS and an access-controlled network boundary, preferably an identity-aware proxy.
Use a separate private GitHub repository if synchronization is enabled.
Grant a GitHub token access only to that vault repository.
Never commit .env, private keys, exports, or browser data.
Test restores and keep an offline backup.

Before committing:

make privacy
git diff --cached

Do not add screenshots, fixtures, test names, example messages, calendar events, file paths, or logs copied from a real installation.