Encrypt everything, because anything can be interpreted maliciously.

Disk image

# Prepare disk image
fallocate -l100M ~/crypt.img
cryptsetup open --type plain -d /dev/urandom ~/crypt.img to_allocate
dd if=/dev/zero of=/dev/mapper/to_allocate bs=1M
cryptsetup close to_allocate

# Format image
cryptsetup -v --key-size 512 luksFormat ~/crypt.img
cryptsetup open ~/crypt.img crypt_img
mkfs.ext4 -O ^has_journal /dev/mapper/crypt_img
tune2fs -m 0 -c 0 /mapper/crypt_img # Don't reserve root space
e2label /dev/mapper/crypt_img Label
cryptsetup close crypt_img

# Open image
cryptsetup open ~/crypt.img crypt_img

# Mount image
mount /dev/mapper/crypt_img /media/enc

# Unmount image
umount /media/enc

# Close image
cryptsetup close crypt_img

Text file

vim -x my_file.txt