18 lines
1.2 KiB
Markdown
18 lines
1.2 KiB
Markdown
# Security notes
|
|
|
|
## Scope
|
|
|
|
The project is an educational MVP. It is designed to demonstrate a client-side encrypted vault and a cautious browser-extension flow. It has not undergone a professional security audit.
|
|
|
|
## Non-negotiable production work
|
|
|
|
1. Serve the web app and API only over HTTPS with HSTS.
|
|
2. Move the dev SQLite store to PostgreSQL, encrypt backups, and test restore procedures.
|
|
3. Put authentication rate limiting and account lockout controls at a trusted edge, with alerting.
|
|
4. Pin and continuously audit JavaScript/Python dependencies and the extension release pipeline.
|
|
5. Add CSP with nonces/Trusted Types, dependency review, XSS testing, CSRF/origin tests, and a threat model.
|
|
6. Review memory lifetime, key derivation parameters, recovery/export, multi-device sync and concurrent revisions with a cryptographer.
|
|
|
|
## Product guarantees
|
|
|
|
The server never needs the master password to read or write a vault envelope. This does not protect against a malicious or compromised server delivering modified JavaScript to a user: a password manager must treat its application delivery path as a high-trust boundary. The extension only fills after a user action and checks exact origins, but a compromised page can read credentials once they are placed in its DOM.
|