News · Security · November 12, 2026

Know when your vault opens, and what happens to scanners

An access journal shows each device that opens your vault and warns you when another one does. Decoys on our relay turn away bots that probe for secrets.

DRIVE 369 DAO · 2 min read

Two small security features shipped this week, one for you and one for us. Both rest on the same idea: you cannot defend what you cannot see.

For you: the access journal

Every time your vault opens, Ghostdrive writes one line: which device, how it was opened and when. The journal keeps the newest 200 entries and syncs between your devices and your backup node, like your other vault documents. You can see it in Settings › Access.

If another device opens your vault, your other devices show an alert: "Your vault was opened on another device." Choose Not me and you land on the page that shows what to do: remove the device, then move your vault to new recovery words.

Honest limit: a client changed by an attacker could leave no entry. The journal catches the ordinary case, not every case, and we say so on the page.

Use case: a lost laptop

You lose a laptop on a train. That evening your phone shows that the vault was opened on the laptop. You choose Not me, remove the laptop, and move to new words. Without the journal you might never have known.

For us: traps on the relay

Our public relay is probed all day by automated scanners asking for files no person would ask for, such as environment files, admin panels and login pages of software we do not run. We now answer some of those requests with decoys. A hit records the network, country, method, path and client, never a body. The network is blocked from the relay's services for 24 hours, and the owner is told. The log is kept for 30 days and then forgotten, and only the owner's signed request can read it or lift a ban. A trap bans only on a strong sign, never because a browser asked for some page.

This is cheap and old: an alarm that rings when someone tries a door that nobody uses. We tell you about it in the Terms because it is better to say what we record.

Why it matters

Most breaches begin with something noticed too late: a login from somewhere new, a scanner finding a forgotten file. Cheap signals that reach a person quickly are part of the answer. In a world where attacks move at AI speed, the time between "someone is trying" and "someone knows" is what we can shorten.

Try it

Open Settings, then Access, and look at the list of openings. If you see a device you do not know, you have your answer.

Settings · Social engineering lesson · Academy: start here