-
-
Frame from the recorded browser demo (Oct 16). All names and reference values are fictional.
-
Frame from the recorded browser demo (Oct 16). All names and reference values are fictional.
Inspiration
A writing request often mixes a public task with private names, amounts or internal references. SealedBrief lets a person separate those parts before asking a hosted model to draft the message: seal the private fields, inspect the outgoing envelope, then reconstruct the complete text locally.
What it does
The workspace supports emails, short messages and summaries. It encrypts marked private values in the browser, shows the public context and encrypted envelope, and validates the model's template before restoring the original values locally.
The default Pollinations option sends the inspected envelope to a real hosted model without an account or API key. The app never silently retries a failed request or replaces it with a sample. A separate deterministic rehearsal exercises encryption and reconstruction without a model call. The local Node build also supports Ollama and optional Gemini/OpenAI adapters; the hosted demo exposes only Pollinations.
Try the public workspace or download the source and local build.
How we built it
Browser-native JavaScript, WebCrypto and AES-256-GCM encrypt each private field under a non-extractable browser-session key. Random IVs and authenticated request/field/label identifiers bind ciphertext to its intended use. The model receives public instructions and opaque references, writes a JSON template, and never receives the encryption key or original private values through this application protocol. Every authorized reference must occur exactly once before the browser decrypts and reconstructs the draft.
The public adapter calls a fixed anonymous Pollinations endpoint directly from the browser, without cookies, referrer or credentials. A Worker serves the site assets and configuration. The dependency-free local Node server offers separate proxy transports, checks origin and host, and binds to loopback. Input/output validation, response-size limits, timeouts and cancellation bound both paths. Application code does not log private drafts, credentials or request bodies.
The boundary and challenges
This is encrypted-field composition, not fully homomorphic inference or secure multiparty computation. The model cannot reason about hidden values. Public instructions, field labels, counts and ciphertext lengths remain visible. A secret copied into public instructions is not protected; a compromised browser or malicious same-origin code is outside the protection offered by this prototype.
Treating model output as untrusted was as important as the cipher. Missing, repeated or unknown references, markup and malformed output are rejected before reconstruction. A valid template can still contain poor or misleading writing, so the user must review it. The rehearsal is visibly distinct from hosted inference.
What we verified
The accompanying video records a real public browser request on October 16, 2026 at 21:08:29.155 UTC: HTTP 200, an app-reported 15,321 ms and four fictional private values reconstructed locally. The full hosted-request interval is preserved at original speed. The downloadable source includes LIVE-PUBLIC-TEST.json, containing the encrypted envelope, validated template and metadata without the original private fields or encryption key.
Separately, the automated suite passed 84/84 tests. Protocol and transport tests include mock responses and rejection paths: tampering, wrong-session decryption, malformed references, credential placement, origin checks, timeouts and cancellation. These are bounded tests, not an external security audit.
A real local Ollama check with qwen3:4b-instruct-2507-q4_K_M restored four synthetic fields; a separate hosted Pollinations check through the local HTTP server also succeeded. LIVE-LOCAL-TEST.json and LIVE-HOSTED-TEST.json preserve those distinct observations. Gemini/OpenAI adapters remain mock-tested; no live credentialed use is claimed. Earlier provider attempts failed, including truncated output and an HTTP 402 on the Worker-proxy route. No payment or automatic fallback was used. One successful demonstration does not establish a reliability rate or universal privacy guarantee.
The recorded application revision was 515b1cc26c9943282e717d86a7f62d8bd5905555. The October 28 publication updated documentation and source packaging; it did not change the application behavior shown. The video shows the original site address, which currently redirects to the linked workspace.
What we learned
A useful privacy claim must identify exactly what remains public and what is reconstructed locally. Showing the outgoing request gives the user a concrete boundary to inspect. Validation must remain strict even when a provider returns a nearly correct result.
What's next
Evaluate provider reliability across varied tasks and invalid outputs. Investigate optional padding to reduce length leakage and a carefully reviewed recovery design. Neither padding nor key recovery is implemented in this prototype.
AI assistance and credits
Developed with substantial assistance from OpenAI Codex and collaborating AI agents, including implementation, tests, documentation and security review. Jhonatan del Rio (EazyHood) supplied the direction and authorized the work. The video uses synthetic English narration generated locally with Microsoft Zira Desktop and fictional example data. It is a recording of the running app with two verified idle pauses removed; captions and narration were added afterward. Standard cryptographic primitives come from WebCrypto. No exclusively human authorship, independent external audit or organizer endorsement is claimed. Source is provided under its included license.
Built for the AI pipeline track of Mathematics for systems security. The hosted model drafts around encrypted fields; it does not infer their contents. This distinction is central to the prototype and its limitations.
