Hey, I heard you’re diving into a new project. Since you’re experimenting a lot, have you thought about how to keep user data private and stay on the legal side?

That’s a good start, but hashing alone isn’t enough for personal data—if someone gets the hash, they might still brute‑force it, especially if you’re using plain algorithms. Add proper encryption, like AES with a secure key, even for a mock‑up, to show you’re treating the data seriously. Also, under GDPR you need a lawful basis and clear purpose, so make sure the data you collect is strictly necessary and that you can prove you’ve stored it securely. Even a TODO is a reminder, but better to at least prototype the encryption so you’re not leaving that gap open. That way you’ll have a solid foundation before you launch.

Sounds like a solid plan. Just double‑check that the key vault you use is truly secure—if the key is hard‑coded or in the same repo, you’re back to square one. Maybe spin up a tiny local HSM emulator or use a dedicated secrets manager so the key never touches the code. That way you keep the prototype clean, and you’ll have a real audit trail if someone does want to dig in. Good luck, and keep the comments honest—future you will thank you.

Nice, that’s the kind of detail that keeps everything tight. Good luck with the HSM setup—keep the env vars secret and the audit trail documented. Cheers!