From dab45e4649ace03cc82b8ca7334782cae33df963 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Feb 2026 14:31:26 +0000
Subject: [PATCH 1/2] Initial plan


From 61de5c04ae004a8901347e3361ac163b82ecb356 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 18 Feb 2026 14:32:45 +0000
Subject: [PATCH 2/2] Update README with comprehensive SecretDrop documentation

Co-authored-by: AleksDoesCode <100039423+AleksDoesCode@users.noreply.github.com>
---
 README.md | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 81 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index ae07eee..d7396da 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,81 @@
-# SecretDrop
-Encrypted file sharing for developers. Upload files, set a password, share a link — everything is encrypted in your browser before it touches a server. Zero-knowledge architecture. No recipient account needed. Or go premium for end-to-end encrypted direct transfers using public-key cryptography.
+# SecretDrop — Encrypted File Sharing for Developers
+
+**Share sensitive files without trusting the server.**
+
+SecretDrop encrypts everything in your browser before it ever reaches a server. Send API keys, credentials, configs, and documents through password-protected links or end-to-end encrypted direct transfers.
+
+**[Get Started at secretdrop.dev](https://secretdrop.dev)**
+
+---
+
+## How It Works
+
+### Password-Protected Links
+1. Upload files and set a password
+2. Files are encrypted client-side with AES-256-GCM
+3. Share the link — recipients decrypt in-browser
+4. No account required for recipients
+
+### E2E Direct Transfer (Premium)
+1. Select recipients by email
+2. Files are encrypted with each recipient's public key (ECIES)
+3. Only intended recipients can decrypt — no passwords, no shared secrets
+4. Sender identity verified via digital signatures
+
+---
+
+## Why SecretDrop
+
+- **Zero-Knowledge Architecture** — The server never sees your plaintext data, filenames, or passwords
+- **Client-Side Encryption** — AES-256-GCM with PBKDF2 key derivation (600,000 iterations)
+- **No Recipient Account Needed** — Password-protected links work for anyone
+- **Multi-File Bundles** — Send multiple files in a single encrypted bundle
+- **Expiration Policies** — Bundles auto-expire based on your settings
+- **Access Analytics** — Track views, downloads, and access attempts
+- **Built on Web Standards** — WebCrypto API, no third-party crypto libraries
+
+---
+
+## Security Model
+
+| What the server stores | What the server cannot access |
+|---|---|
+| Encrypted file blobs | Plaintext file contents |
+| Encrypted filenames | Original filenames |
+| Verification hash + salt | Your password |
+| Metadata (title, timestamps) | The encryption key |
+
+Private keys for Direct Transfer are encrypted with your password before storage. They never leave your browser unencrypted.
+
+---
+
+## Tech Stack
+
+- React 19, Vite, Tailwind CSS
+- NestJS, Supabase (Postgres, Auth, Storage)
+- WebCrypto API for all cryptographic operations
+- Astro for the marketing site
+
+---
+
+## Pricing
+
+| | Free | Premium |
+|---|---|---|
+| Password-protected bundles | 1 active | Unlimited |
+| Bundle expiry | 7 days | Custom |
+| E2E Direct Transfer | — | Included |
+| Access analytics | Basic | Detailed |
+| Multi-recipient transfers | — | Included |
+
+---
+
+## Links
+
+- **Website:** [secretdrop.dev](https://secretdrop.dev)
+- **Security Model:** [secretdrop.dev/security](https://secretdrop.dev/security)
+- **FAQ:** [secretdrop.dev/faq](https://secretdrop.dev/faq)
+
+---
+
+Built for developers who take security seriously.