Summary
PR #352 corrected several stale/false security claims in `locales/en/help.json` (see also `docs/IDB-ENCRYPTION.md`, `docs/SECURITY-THREAT-MODEL.md`). During Wave 0 review-thread remediation (2026-08-18, see `docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md` §65 and PR #352/#365/#366's review threads), these corrections were propagated to all 5 production-tier locales (en/de/es/fr/it) but not yet to the remaining 14 (ar, he, el, ja, zh, pt, fa, fi, sv, hu, is, eu, ru, ko), per this repo's established two-tier i18n practice (/i18n-key skill covers the 5 production locales; the rest are updated manually afterward — see CLAUDE.md § i18n).
What was fixed in en/de/es/fr/it
- Removed a false Stronghold claim —
help.docs.tauriDesktop.content claimed tauri-plugin-stronghold can store the IDB passphrase; no such dependency exists anywhere in the codebase. Already mechanically removed from all 13 locales that had it (this part of the fix is already propagated everywhere: de, el, eu, fa, fi, hu, is, ja, ko, pt, ru, sv, zh).
- Corrected the API-key encryption mechanism description — several Help entries claimed API keys are "PBKDF2-encrypted before being stored in IndexedDB." This is wrong:
services/storage/idbKeyStore.ts uses a random, non-extractable generated key — no passphrase, nothing to derive, no PBKDF2 involved. PBKDF2 is only used for the opt-in project-data-at-rest passphrase (a different, unrelated feature) and for collaboration E2E encryption.
- Scoped "never sent to any WorldScript server" claims with the Claude/Anthropic exception — on the web/PWA build, Claude requests relay through WorldScript's own stateless serverless proxy (never logged) since Anthropic blocks direct browser requests; desktop calls Anthropic directly like every other provider. The blanket "never transmitted" claim was misleading for this one case.
- Scoped "all data lives in your browser's IndexedDB/OPFS" claims to Browser/PWA — on the Tauri desktop build, project data lives in local files under the app's data directory, not the browser storage APIs.
Affected keys (same 4-5 per locale): help.aiStudio.providers.content, help.faq.api.content, help.faq.privacy.content, help.gettingStarted.desktop.content, help.docs.privacySecurity.content.
Remaining work
Apply the equivalent corrections (2-4 above; the Stronghold removal is already done everywhere) to:
Use the corrected English/German/Spanish/French/Italian text (git history on locales/{en,de,es,fr,it}/help.json, commits from 2026-08-18) as the reference for what each locale's equivalent sentences should say. Run `pnpm run i18n:check` after editing to rebuild bundles and verify key parity.
Not attempted in this pass: translation quality/accuracy risk for security-sensitive content in languages without a confident reviewer in this session (particularly CJK, RTL, and Cyrillic scripts) outweighed doing a rushed mechanical find-replace.
Summary
PR #352 corrected several stale/false security claims in `locales/en/help.json` (see also `docs/IDB-ENCRYPTION.md`, `docs/SECURITY-THREAT-MODEL.md`). During Wave 0 review-thread remediation (2026-08-18, see `docs/cef/ROADMAP-CEF-DESKTOP-MIGRATION.md` §65 and PR #352/#365/#366's review threads), these corrections were propagated to all 5 production-tier locales (en/de/es/fr/it) but not yet to the remaining 14 (ar, he, el, ja, zh, pt, fa, fi, sv, hu, is, eu, ru, ko), per this repo's established two-tier i18n practice (
/i18n-keyskill covers the 5 production locales; the rest are updated manually afterward — seeCLAUDE.md§ i18n).What was fixed in en/de/es/fr/it
help.docs.tauriDesktop.contentclaimedtauri-plugin-strongholdcan store the IDB passphrase; no such dependency exists anywhere in the codebase. Already mechanically removed from all 13 locales that had it (this part of the fix is already propagated everywhere: de, el, eu, fa, fi, hu, is, ja, ko, pt, ru, sv, zh).services/storage/idbKeyStore.tsuses a random, non-extractable generated key — no passphrase, nothing to derive, no PBKDF2 involved. PBKDF2 is only used for the opt-in project-data-at-rest passphrase (a different, unrelated feature) and for collaboration E2E encryption.Affected keys (same 4-5 per locale):
help.aiStudio.providers.content,help.faq.api.content,help.faq.privacy.content,help.gettingStarted.desktop.content,help.docs.privacySecurity.content.Remaining work
Apply the equivalent corrections (2-4 above; the Stronghold removal is already done everywhere) to:
Use the corrected English/German/Spanish/French/Italian text (git history on
locales/{en,de,es,fr,it}/help.json, commits from 2026-08-18) as the reference for what each locale's equivalent sentences should say. Run `pnpm run i18n:check` after editing to rebuild bundles and verify key parity.Not attempted in this pass: translation quality/accuracy risk for security-sensitive content in languages without a confident reviewer in this session (particularly CJK, RTL, and Cyrillic scripts) outweighed doing a rushed mechanical find-replace.