My Security App Used to "Encrypt" Passwords With XOR. Here's the Post-Mortem I Wish More Devs Wrote.

Most security software marketing sounds the same: "military-grade encryption," "unbreakable," "100% secure." I want to try something different. I'm going to tell you about a real mistake in an earlier version of my app, ATLOCK, how I found it, and exactly what replaced it — because I think more builders should talk about the version of their product they're embarrassed by. What ATLOCK actually does ATLOCK is a Windows security suite with four modules: Lockdown — system-level screen lock with a countdown timer and OS hardening File Guard — locks files at the NTFS ACL level, so they're genuinely unreadable, not just hidden Password Vault — AES-encrypted storage for emails, UPI IDs, PINs Intruder Ops — the fun one. First wrong password: a photo. Third or fourth wrong attempt: a 10-second video. Alarm sound. Everything saved straight to your Pictures/Videos folders. It's the kind of app you build after someone gets into your laptop one too many times and you decide "never again" isn't a feeling, it's a feature request. The mistake I'd normally bury in a changelog Earlier builds of ATLOCK's Password Vault used XOR to scramble stored credentials. XOR is not encryption — it's obfuscation with a fancy name. It's the kind of thing that looks fine in a quick demo and would fall apart in about five minutes against anyone who actually tried. Most projects would quietly fix this and move the changelog line to the bottom where nobody reads it. I'd rather say it plainly: that was a real weakness, in a real released version, and if you were relying on it, it wasn't protecting you the way you thought. What actually replaced it (this is the part I'm proud of) Real crypto, not "crypto-shaped" crypto. v4 replaced XOR with Fernet (AES-128-CBC + HMAC), and the master password goes through PBKDF2-HMAC-SHA256 with 200,000 iterations and a random salt per install. Intruder attempts are masked before they touch disk. Whatever password a snooper types, it never gets logged or stored in plaintext — it's masked immediately, before any logging call happens: python def mask_password(pw: str) -> str: """ Mask an intruder attempt so we never store/email the full plaintext. Returns 'a*** (5 chars)' or '(empty)' for blank attempts. """ This matters more than people think. A lot of "security" tools log failed attempts in full to help with debugging, then that log file becomes its own liability. File locking at the ACL layer. File Guard doesn't hide files or rename them with a weird extension — it modifies Windows NTFS access control lists directly, so the OS itself refuses to serve the file to unauthorized processes. No string-injected shell calls. Notification toasts go through PowerShell safely, with no raw string interpolation into the command — a small thing, but it's exactly the kind of small thing that turns into a CVE in other people's projects. Why I'm telling you all this Because the alternative — a landing page that just says "bank-grade security" and hopes nobody reads the code — is how trust in security software erodes for everyone, not just the sketchy apps. If you're evaluating any security tool, ask what its "XOR era" was and whether the team is willing to talk about it. If the answer is "we've always been perfect," that should worry you more than an honest post-mortem ever would. ATLOCK v4 is built in Python with customtkinter, cryptography, and opencv-python. Happy to go deeper into the NTFS ACL handling or the vault's key derivation in the comments if there's interest. — Akhouri Anmol Kumar, Akhouri Systems ATLOCK "We Build What Others Forgot To Fix"