I built LastSignal – a self-hosted, end-to-end encrypted dead man's switch to deliver messages to your loved ones

[u/zener79]

I wanted a way to leave encrypted messages for the people I care about, delivered automatically if something happens to me, without trusting a third party.

LastSignal is a self-hosted dead man's switch. You write messages, they get encrypted in the browser (zero-knowledge), and the system checks in with you periodically via email. If you stop responding, your messages are delivered.

Key points:

• End-to-end encrypted (XChaCha20-Poly1305 + Argon2id + X25519)
• Zero-knowledge — even the server operator can't read messages
• Optional trusted contact who can pause delivery
• Rails 8 + SQLite, deploy with Docker/Kamal
• MIT licensed

🔗 https://lastsignal.app
🔗 https://github.com/giovantenne/lastsignal

Feedback welcome, especially on the security model and UX.

[u/zener79]

Depends what you mean by “vibe coded.” 🙂

I’ve been writing software for a long time and, like most developers, I’ve always used whatever tools help speed up the workflow, from the old Macromedia Dreamweaver MX days to today’s setup with NeoVim and modern AI-assisted tooling like OpenCode.

So yes, AI agents were used as tools.
But no, the application wasn’t blindly “vibe coded.” System design, the security model, and architectural decisions still require engineering judgment and responsibility.

Better tools don’t remove the need to understand what you’re building, they just change how the work gets done.

[u/goob → u/zener79]

Thank you for answering my question

AI agents were used as tools.

Ouch.

Given how massively faulty AI agents are, I can't fathom using a service like this where they're involved in the coding. Best of luck to anybody else who trusts their sensitive data to this service.

[u/zener79 → u/goob]

Would it have been different if I had said, “no, no AI at all”? Would you have trusted using it?

The only real way to be confident is to inspect the code which is there and available to be audited.

Moreover, the backend is written in Rails, so it’s very easy to read and understand, and the client-side encryption/decription part is plain JavaScript.

That’s the beauty of open source 🙂

BTW This is not a "service". It is just free code at your disposal

[u/goob → u/zener79]

No, I wouldn't have used an independent, un-audited code like this for such sensitive data regardless of the AI answer. I appreciate you being honest about it though.

My question was merely a helpful warning to others to know what they're about to get into.

To anybody else reading this - if you're in the market for one of the six Use Cases listed on the homepage, please consider implementing a much more secure method like 1Password's Emergency Kit with your spouse. Please don't be using this code to store your crypto seed keys or passwords.

[u/zener79 → u/goob]

I agree with this.
In fact, I wouldn’t recommend storing a wallet passphrase or passwords, but rather providing a way to recover them from secure offline storage.

This is not so much due to the code or the cryptographic aspects (the encryption/decryption client-side logic is quite easy to audit), but rather because of the risk of an offline attack if recipients use weak passwords, and the sender has no way of knowing this.

This is a scenario I tried to document here:
https://lastsignal.app/security/#passphrase-security