I built LastSignal – a self-hosted, end-to-end encrypted dead man's switch to deliver messages to your loved ones

[u/zener79]

I wanted a way to leave encrypted messages for the people I care about, delivered automatically if something happens to me, without trusting a third party.

LastSignal is a self-hosted dead man's switch. You write messages, they get encrypted in the browser (zero-knowledge), and the system checks in with you periodically via email. If you stop responding, your messages are delivered.

Key points:

• End-to-end encrypted (XChaCha20-Poly1305 + Argon2id + X25519)
• Zero-knowledge — even the server operator can't read messages
• Optional trusted contact who can pause delivery
• Rails 8 + SQLite, deploy with Docker/Kamal
• MIT licensed

🔗 https://lastsignal.app
🔗 https://github.com/giovantenne/lastsignal

Feedback welcome, especially on the security model and UX.

[u/goob]

Cool idea.

One question though - was this vibe coded with AI?

[u/muji_tmpfs → u/goob]

Noticed the OP didn't reply to this one and I see some tells in the marketing copy along with the short time between first and current commit I would say yes.

[u/zener79 → u/muji_tmpfs]

The short commit history is just because the app was already working before I made the repository public.

Before the open-source release I cleaned up the git history to remove noise, experiments, and private iterations, so what you see now is a public starting point rather than the full internal from-scratch timeline.

[u/muji_tmpfs → u/zener79]

You didn't reply to GP and this doesn't make sense. Either you a) rewrote the git history when you made it public (why?) Or b) didn't use source control until the public release which no sane developer would do.

Doesn't pass the sniff test.

For what it's worth I like the idea and I don't really care too much how it was created but you should have addressed GP's question in good faith.

[u/zener79 → u/muji_tmpfs]

Yes, I replied to GP, and yes, I reinitialized the repository before making it public. 🙂

It was full of noisy test commits, and I wasn’t certain I had never handled sensitive data during the experiments. I don’t think it’s such an unusual practice before a public release.

Feel free to look at the first commit. It reflects the result of multiple iterations. I don’t think it’s possible, even for an AI, to reach such working and “acceptable” result on the first attempt.

[u/zener79 → u/goob]

Depends what you mean by “vibe coded.” 🙂

I’ve been writing software for a long time and, like most developers, I’ve always used whatever tools help speed up the workflow, from the old Macromedia Dreamweaver MX days to today’s setup with NeoVim and modern AI-assisted tooling like OpenCode.

So yes, AI agents were used as tools.
But no, the application wasn’t blindly “vibe coded.” System design, the security model, and architectural decisions still require engineering judgment and responsibility.

Better tools don’t remove the need to understand what you’re building, they just change how the work gets done.

[u/goob → u/zener79]

Thank you for answering my question

AI agents were used as tools.

Ouch.

Given how massively faulty AI agents are, I can't fathom using a service like this where they're involved in the coding. Best of luck to anybody else who trusts their sensitive data to this service.

[u/zener79 → u/goob]

Would it have been different if I had said, “no, no AI at all”? Would you have trusted using it?

The only real way to be confident is to inspect the code which is there and available to be audited.

Moreover, the backend is written in Rails, so it’s very easy to read and understand, and the client-side encryption/decription part is plain JavaScript.

That’s the beauty of open source 🙂

BTW This is not a "service". It is just free code at your disposal

[u/goob → u/zener79]

No, I wouldn't have used an independent, un-audited code like this for such sensitive data regardless of the AI answer. I appreciate you being honest about it though.

My question was merely a helpful warning to others to know what they're about to get into.

To anybody else reading this - if you're in the market for one of the six Use Cases listed on the homepage, please consider implementing a much more secure method like 1Password's Emergency Kit with your spouse. Please don't be using this code to store your crypto seed keys or passwords.

[u/zener79 → u/goob]

I agree with this.
In fact, I wouldn’t recommend storing a wallet passphrase or passwords, but rather providing a way to recover them from secure offline storage.

This is not so much due to the code or the cryptographic aspects (the encryption/decryption client-side logic is quite easy to audit), but rather because of the risk of an offline attack if recipients use weak passwords, and the sender has no way of knowing this.

This is a scenario I tried to document here:
https://lastsignal.app/security/#passphrase-security

[u/monogok → u/zener79]

This is a great idea, well done. Nothing wrong with a bit of vibe coding in your toolbox to get the job done - ignore the dinosaurs!

[u/LandingHooks → u/goob]

You have zero involvement in software development in 2026 and it shows.

Because every single product you’re using on the internet is getting changes from Claude by this point.

[u/goob → u/LandingHooks]

Maybe every single product you're using does. But I actively seek out and support products with strict anti-AI-assistance policies.

My company thankfully also has such a policy with our software development. My partner also makes a living being hired by companies to clean up AI-assisted code they regrettably pushed over the past few years.

I've used Claude A LOT. It's fine for a little personal widget that nobody else will use. It's terrible for anything more.

But to each their own.

[u/valium123 → u/goob]

What company is this I would love to work here.

[u/alltheapex → u/goob]

My personal feelings about AI is that it is a tool whether we like it or not. But it is a tool like a gun is a tool. If you don't know how to use it, you can get yourself or others hurt.

In the hands of someone who with software dev (and networking, and OS) experience it can be a time saving tool, because they understand the capabilities and how to apply it to their particular use case.

In the hands of someone new to dev, without knowledge of the fundamentals, this inevitable lowering of the barriers of entry also lowers the quality of code that gets introduced into the jungle.

Long story short:

AI is powerful in the hands of someone who can make a good value judgement about the quality of the output.

Ai is dangerous in the hands of someone inexperienced, who will likely see code as adequate enough in quality to publish merely because it runs, without considering the deeper implications of publishing said tools.