no passphrase required to read Folders

I've added a few files under the KB filesystem:

/keybase/
├── private/
│   └── florinandreicurb/
│       └── private-test.txt
├── public/
│   └── florinandreicurb/
│       └── test.txt
└── team/
    └── XXXXXXXX/
        └── test.txt

After restarting my laptop, I was able to access those files without being prompted for any password. That shifts the burden of security onto the laptop's account password and disk encryption.

I could not do the same test on Android because KB is not exposing the folders to the mobile app yet.

So technically this is either the same as storing those files on your laptop in plain text (if a local plaintext copy is stored all the time in /keybase) or nearly the same (if the Keybase helper service is required to run to access those files). In the first case, disk encryption is mandatory to protect the files; in the second case, a strong account password on the laptop is mandatory.

Either way, I would feel a lot better if KB asked you to enter your GPG password at least once to read those files.

Perhaps this is just because the Folders feature is pretty new?

Or, in case I misunderstand the way things work: with Keybase, how do I regain the same level of protection I had when I was using GPG? How do I make sure the secrets stored in KB are protected by more than just the account password on my laptop? (or the PIN on my phone)

Start by reproducing access to the listed /keybase/private, /keybase/public, and /keybase/team folders after restarting the laptop, and determine whether a local plaintext copy or the Keybase helper service provides access. No source file or test is named; done would require a clear security decision and documented behavior for protecting folder contents with more than the device account password or PIN.