KanTrack is a privacy-first, local-only Kanban board built for focus and clarity. No accounts. No cloud. No distractions — just you and your work.

Features

• Four-column board — To Do, In Progress, On Hold, Done
• Rich task details with notes, timers, priorities, due dates & tags
• Built-in Notebook for freeform notes and documentation
• World clocks and chronometer widgets
• Full-text search, column filters, and tag filters
• Keyboard shortcuts for efficient navigation
• Export to PDF, HTML, JSON, and encrypted backup
• Undo / redo for all task actions

Where Your Data Lives

Nothing is sent to any server. KanTrack has no backend, no accounts, and makes no network requests. All storage is local to your browser.

What KanTrack Protects Against

• XSS via imported data — an allowlist-based sanitizer strips all event handlers and unsafe tags before any HTML is rendered to the page
• Inline script injection — a strict Content Security Policy (script-src 'self') blocks inline scripts and javascript: URL execution
• Malicious import files — the sanitizer also runs on content from imported .kantrack.json workspace files
• Encrypted exports use AES-256-GCM with PBKDF2 key derivation (100,000 iterations, SHA-256)

Known Limitations — Read These

• Device compromise — if your device is infected or physically accessed, data in localStorage and IndexedDB is readable. KanTrack cannot protect against OS-level access.
• Browser extensions — extensions with broad permissions can read page content and storage. Use a minimal-extension browser profile for sensitive data.
• Unencrypted exports — standard .kantrack.json exports are plain JSON. Use the encrypted export for sensitive data.
• Data at rest — KanTrack does not encrypt data in localStorage or IndexedDB. Anyone with access to your logged-in account can read it via browser DevTools.
• Password strength — the encrypted export is only as strong as the password you choose.

We cannot protect your data if your device is compromised. That is an honest limitation we cannot engineer away.

Report a Vulnerability

Found a security issue? Do not open a public issue.
Contact: general@bosslesstechindustries.com