1.2 KiB
1.2 KiB
Security notes
Scope
The project is an educational MVP. It is designed to demonstrate a client-side encrypted vault and a cautious browser-extension flow. It has not undergone a professional security audit.
Non-negotiable production work
- Serve the web app and API only over HTTPS with HSTS.
- Move the dev SQLite store to PostgreSQL, encrypt backups, and test restore procedures.
- Put authentication rate limiting and account lockout controls at a trusted edge, with alerting.
- Pin and continuously audit JavaScript/Python dependencies and the extension release pipeline.
- Add CSP with nonces/Trusted Types, dependency review, XSS testing, CSRF/origin tests, and a threat model.
- Review memory lifetime, key derivation parameters, recovery/export, multi-device sync and concurrent revisions with a cryptographer.
Product guarantees
The server never needs the master password to read or write a vault envelope. This does not protect against a malicious or compromised server delivering modified JavaScript to a user: a password manager must treat its application delivery path as a high-trust boundary. The extension only fills after a user action and checks exact origins, but a compromised page can read credentials once they are placed in its DOM.