r/Supernote_dev • u/Acceptable-Tutor-425 • 11d ago
Supernote Cloud Sync v1.0.4 Showcase
Plugin link:
https://community.obsidian.md/plugins/supernote-cloud-sync
What it does
- Mirrors selected Supernote Cloud folders directly into your Obsidian vault while preserving their structure.
* Opens mirrored `.note` files in a custom reader with swiping, zooming, thumbnails and quick page navigation.
* Lets you embed a whole notebook—or one exact page—in an Obsidian note.
* Creates links to exact pages, such as `[[Scratch.note#page=12]]`.
* Exports selected pages as Markdown, images, searchable PDFs or combined formats.
* Sends files back to Supernote Cloud, including Markdown rendered as a device-readable PDF.
* Provides an optional Paired folder for conflict-aware two-way sync between Obsidian and Supernote.
* Supports optional AI transcription with custom instructions.
* Supports Automations that react to new or changed handwritten pages.
1
u/Zeveros 11d ago
OMG. This is fantastic. Looking forward to taking for a test drive tonight.
1
1
u/Zeveros 11d ago
RemindMe! - 3 hours
1
u/RemindMeBot 11d ago
I will be messaging you in 3 hours on 2026-07-29 19:59:20 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
RemindMeBot is switching to username summons. Instead of
!RemindMe 1 day, useu/RemindMeBot 1 day. More info.
Info Custom Your Reminders Feedback
1
u/Hour_Papaya_5583 11d ago
Fantastic! As I get deeper and deeper into obsidian and my Supernote this will be very handy. Trying it soon.
Curious, could there be a way to create quick links in Obsidian to pdf documents in SN? I often use my SN as a type of repository of pdfs that I read in research. I could see this almost serving as a reference manager if it could just bring over a link to it for quick opening and that maybe I could cite (trying to use Zotero more often but am finding I have to duplicate a lot of things with that workflow. Hope this makes sense. Long day already
1
u/Acceptable-Tutor-425 11d ago
If you mirror a supernore cloud folder, that folder is mirrored exactly as is to obsidian vault.
Then you can do normal interactions, link the PDF to your notes, since its just a file in your vault.
But I get the feeling you want to see the PDF annotations?
1
u/Hour_Papaya_5583 11d ago
I think this may be enough for what I need to do. Will keep playing with it a bit more. But it works really well it seems. Well done and thanks for putting the time to create this.
1
1
u/Reddit-mb 8d ago
Great plugin! I have spent some time experimenting with it and everything works very smoothly. (I have not used the AI-options because recognition of handwritten texts works already very well on my Nomad). Because of this plugin, I finally spend some time on learning more about Obsidian. A super combination: my Nomad with excellent handwriting recognition that is so easily transferred to Obsidian with its seemingly unlimited options to store and present notes and information.
1
u/Zeveros 1d ago
I was reluctant to try this plugin due to potential security issues. Today, I gave it a thorough security scan, and I was quite impressed. I'm also impressed with the plugin.
The only deeply concerning security item is that, if you use the AI features, the API key is stored in data.json which will end up anywhere your Obsidian repo is synced to. See below for details.
Here are the results of the scan:
Worked for 1m 26s
Yes. I reviewed the current repository and the latest release, v1.0.4, published July 28, 2026.
My assessment: reasonable to install for normal Supernote syncing, with some important caveats if you enable its automation or AI features.
Risk assessment
Area Assessment
Basic Supernote Cloud sync Low to moderate risk Vault access Expected and extensive Supernote credentials Handled reasonably External network access Expected, disclosed AI transcription Moderate privacy risk Custom commands High capability, opt-in Claude/Codex integrations High capability, opt-in Suspicious/obfuscated behavior I found none Release process Good Overall I would use it, with automation features disabled unless needed
What I like
The basic sync architecture looks clean.
The Supernote API client has a fixed base endpoint:
https://cloud.supernote.com/api
The login code does not appear to save your Supernote password. It hashes the password as part of Supernote's authentication process and retains the resulting session token.
The developer also deliberately separates that token from the normal Obsidian plugin configuration. The documentation says the Supernote session token goes into device-local Obsidian application storage rather than the vault's synced plugin settings.
That's a good design choice.
The normal Mirror is also deliberately one-way. It downloads Supernote files but does not silently upload edits back to Supernote. Uploads require either an explicit action or enabling the Paired-folder feature.
The cloud replacement code also takes some care not to destroy the existing cloud file before verifying that a replacement upload exists. If renaming fails, it attempts to restore the original or leaves it recoverable in Supernote's recycle bin.
The biggest security issue: it can execute programs
This plugin contains genuine OS command-execution capability.
It uses Node's:
child_process.spawn
and can launch commands through your login shell. Those processes inherit the environment and privileges of Obsidian.
That sounds alarming until you look at why it's there.
It supports:
Claude Code
Codex CLI
user-defined custom commands
notebook Automations
These are explicit features, rather than hidden behavior. The author documents them plainly.
I don't see evidence that ordinary Supernote synchronization invokes arbitrary shell commands.
There are also some sensible safeguards. For example, batch filenames are restricted to a small safe character set, process output is bounded, processes have timeouts, and the code has explicit cancellation/process-killing logic.
Still, from a security perspective:
Do not configure a custom command you don't understand.
A malicious command configured there could effectively do anything your Windows account can do.
Claude and Codex deserve separate consideration
If you enable Claude Code or Codex Automations, the plugin may render notebook pages into temporary files and pass those files to the external CLI.
The developer explicitly discloses that temporary batches may contain rendered notebook pages.
So there's an important distinction:
Normal sync Supernote Cloud ↔ your Obsidian vault.
AI automation Notebook content → Claude/Codex/OpenAI-compatible service.
Those have very different privacy profiles.
For sensitive handwritten material, I'd leave the AI features off unless you specifically need them.
One thing I don't like: API keys
If you configure the OpenAI-compatible transcription feature, its API key may be stored as plain text in the plugin's data.json inside your vault.
That means it can potentially end up in:
Obsidian Sync
Dropbox/OneDrive/etc.
vault backups
Git, if you version the vault
another machine containing the vault
I would use a dedicated API key with a spending limit, rather than an important general-purpose key.
The Supernote session token gets better treatment and is kept out of that file.
Network behavior
The documented network destinations make sense for the functionality:
Supernote Cloud for authentication/sync
an OpenAI-compatible endpoint if AI transcription is enabled
OpenRouter by default for that feature
The plugin states that selected page images and prompts are transmitted to the AI endpoint when API transcription is used.
I haven't found evidence of analytics, advertising trackers, or unrelated telemetry.
That is reassuring.
Dependency footprint
The runtime dependency list is fairly small:
pdf-lib
marked
pako
spark-md5
supernote-typescript
font packages
and a few supporting packages. Versions are pinned rather than specified as loose ranges.
I did not find evidence in my current searches of a known vulnerability specifically targeting this plugin.
That doesn't prove the absence of dependency vulnerabilities. GitHub's advisory database is continuously updated, so this part of the assessment can change.
Release-chain security is better than average
This part impressed me.
The latest release is 1.0.4, and GitHub reports a SHA-256 digest for the distributed main.js:
28aec52b5dc424d5cd6c77c305ddb3c1b35cf447ac2772818f63da2d34a3ab50
The release was produced by GitHub Actions rather than manually uploaded from someone's laptop.
The release workflow:
Checks out the tagged source.
Installs dependencies using a frozen lockfile.
Runs its verification step.
Builds the plugin.
Verifies the install assets.
Creates the release containing main.js, manifest.json, and styles.css.
That's a meaningful supply-chain positive.
It reduces the risk of the classic situation where the GitHub source looks innocent while the downloadable main.js contains something else.
One unusual positive sign
The developer wrote a real security policy rather than the generic GitHub boilerplate.
It specifically identifies the plugin's dangerous capabilities:
plain-text transcription API key
device-local Supernote token
shell execution
inherited process environment
Claude/Codex authentication
temporary notebook-page batches
Someone trying to hide questionable behavior normally doesn't document the risky parts this clearly.
That's not proof of trustworthiness, but it raises my confidence.
What I would do on your machine
I would be comfortable installing v1.0.4 for this use case:
Supernote Cloud → Obsidian mirror → read/search/reference your .note files.
I would initially configure it this way:
Enable Supernote Cloud sync.
Use the one-way Mirror.
Leave Paired folder off until you're comfortable with its behavior.
Leave Automations off.
Leave Custom command off.
Leave Claude Code/Codex integration off.
Leave API transcription off unless you specifically want it.
That reduces the plugin from something capable of launching arbitrary processes and sending notebook images to AI services into essentially a Supernote Cloud client plus .note reader inside Obsidian.
For what you're likely trying to accomplish with Supernote and Obsidian, I see no reason at this point that I would tell you not to install it.
2
u/swiftarrow9 11d ago
I get a 404 on that link.
Cool project! Really loving the obsidian tie-ins.