# The OS still treats every program as you

> File permissions are granted to users, not programs. HJFS isolates each program's files on a stock kernel. Start here for the prototype.

---

LLMS index: [llms.txt](/llms.txt)

---

---

*HeartSuite Joint File System | Prototype*

---

**Overview**: By default, every program you run gets full access to your files, including malware. HeartSuite Joint File System (HJFS) gives each program its own storage area, including programs running as root.

HJFS works on a standard Linux kernel. Which programs run and which network connections they open stay with [Root Lock by HeartSuite](../../rootlock/). On a Root Lock kernel, both can share the host. HJFS also runs on a standard unmodified kernel.

## In this section

- [The security problem HJFS solves](security-problem/) — Why default OS file permissions enable malware damage and how HJFS closes that gap.
- [HJFS overview](hjfs-overview/) — Core mechanisms, per-version storage, secure file transfer, version management, and patents.
- [Walkthrough](walkthrough/) — A short CLI example showing per-version isolation and rollback in action.
- [Protection limits](limits/) — Where the file isolation boundary holds, and what to use alongside it.

---

Section pages:

- [Your word processor inherits every file you own](/hjfs/introduction/security-problem/): Malware encrypts your files with the same open() your editor uses. HJFS keeps custody with you, not with the program you ran.
- [Each program gets its own storage area](/hjfs/introduction/hjfs-overview/): HJFS confines programs to their own files. The OS default — every program inherits your documents — is the hole this closes.
- [Where the file isolation boundary holds](/hjfs/introduction/limits/): Where HJFS file isolation holds, where a program can still hurt you inside its own area, and what to run alongside it.
- [Walkthrough: per-version isolation](/hjfs/introduction/walkthrough/): Upgrade a program, keep v1's data out of v2's reach, roll back. A short CLI walkthrough of HJFS per-version isolation.