Comment by imgopaal

Fixed. Each user now has a unique encryption key derived via PBKDF2 from master key + user ID. Old items are being re-encrypted in the background. See /data-security for details.

Thanks for catching this critical issue.