From 519e8fbd48ac94a673589f623d2f6e3e7775f61f Mon Sep 17 00:00:00 2001 From: Zaki <18zaki18@gmail.com> Date: Sat, 23 May 2026 00:07:00 +0100 Subject: [PATCH] chore: untrack vault.db (contains user secrets) vault.db was tracked from the start of the repo, meaning every commit since the initial import has captured snapshots of the user's password data. Even though entries are AES-GCM encrypted in the DB, the file also contains: - PBKDF2 salt + hash of the master password (offline-crackable) - Audit log with timestamps + IP addresses - Session tokens (transient but historical) - Login attempt counters per username Future commits no longer include vault.db. The Delphi/PHP backend auto-creates the schema via CREATE TABLE IF NOT EXISTS on first run, so a fresh clone needs no migration step. Also ignore the SQLite sidecar files (-journal, -wal, -shm). NOTE: this only stops future leaks. The historical commits still contain old snapshots. Purging history requires git filter-repo + force-push, which rewrites every commit hash and breaks existing clones. See README for instructions if a history purge is desired. --- .gitignore | 8 ++++++++ vault.db | Bin 90112 -> 0 bytes 2 files changed, 8 insertions(+) delete mode 100644 vault.db diff --git a/.gitignore b/.gitignore index bb5b310..003ba7f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,14 @@ vault-error.log +# Vault database — contains user secrets (encrypted but still secret). +# Auto-created on first run by the Delphi/PHP backend via InitDatabase(). +# Never track this file. Use vault.db.example for schema reference if needed. +vault.db +vault.db-journal +vault.db-wal +vault.db-shm + # Delphi build artifacts *.dcu *.dcp diff --git a/vault.db b/vault.db deleted file mode 100644 index 6eb1b9a980872deb96221ae6a4e3c36b6cedf35d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 90112 zcmeI53w#_`eeZYn{hlO>qsX?99BJk|Xa47R&Ybz5vortynbZAKi)O1ew=knFwj$3B9*XkZ)7t9s_+R7k zcy59JDqnH<#b5aY{!eZAeVbpQj5{yxO+-u&P4#<%ucAMld@vD9_Itk>XpMd({HD-v zMdzb8$G%7PM?SGl5ig+4rCXDsMuezWo?BG4oH?)N^V8!*1n$c){e2!q256#XP{?r z^l+74%9{%pHykoJG}<~i*5AKQtXqb;&iKu>E0>lzyw0sAlFjb}zX28P!U zJ3chh(|cmju549L^EH2jYMP^F*H5q^^7tAY?Kuw(w55@7-DcI9ZTFkA z`ohXQRuy-iD{~9Rb|pU7lOOO;EYIDpg|AMJp6) zY;LAr*-w+I;)|$IV`C$=y3ZEczM}1ayfqTro32aW^=oNc?J5`2 z2A#KFmw7d}xZU-%EAiJlA#T%)YHng~(^WOEO&b<>C|#I}h8kO1s8X9Pkh)|{Endvc zO;mr0)d*GHd|hH~xPPoSwyH0}HLzXXr{*{HjopipF7!u2jp;O1JY&}tYB@CvU2@T! znP1G;{uQmMb?v?%yXtFoSnv7Oo9dbor1!A$-6tCNJb(w0)tCKb29X{**f@?T&(y48 zUd><5!BBQlU0R&8|F&-noBWWAY#m4AhUjyiFm|^t#Dk3o4^k^-W6Qfu@Q^5NOs;^A2X{>iH|^Eor!7qiR0cXQe7h7#ELc4f2Gvat>6 zqv2pKR*< zvWt^n`(L1@`fD5iqv~8|oLRq1ZN2mCs&4DU_VwJO*GnniG%H^C;Z|&Dx;)Gs2?QHE z_HB1Lu4#6WUHc_C>?s5a3Dk5=ou0a#Te+QOZl9j-Uml+r zyQKEdPt2&p)8l8))~I+?**+%H1=n$*ZO%>ny{V ziYDo*r7bahQYC_!swO( zO$6066rMqbAc!)@V@n0ylw?@}jI&tQFmY2WoWiQQ$gz@Xa+V;NaIB!366mJ#ItNzE z&>Soa>gtv(%7VmOtZ0a$i9i%XkZO(Or7VvMt^Tm5(KZrG$*LmHvK&%O%VNMHRc3UB zS9o19pnIvf$3atp8LFm8nrbOvx`kEdSw&EI#7jI6HAAdn35KFs(0LH_O_fzR*doZh zW=hcNvLG_1Ad5Q3>ZYt4yvaeg;Y7jOWTKcAP@&Bi_B2&ZR1{qoEz#8B2nng8#mmrg zs>SjeoEz*^6_L|f=!lZaBbL`i(SR-`@`eP0n;bG^U6sHf(PS+}<1Ee4;Tl2=Z}OVK z%e<^|f`TlAS3z%GRdhxL`y>;Z2Wp|Qn{5=bJX2`#hT-DI*A13Y)OZ&9mu@nW3fH49 zN|Gq*h-XYwGz1Ykr7B5qEeRHq;6eeDGy%Fg5+z+QO}q0N(8Y8eiHdAOx3S>b5hX=s zRHSOGp=pLJYEXBi$zYzsAqkp5<0KX7nxGoBDk3qF>~A zroT>qjQ;-m0P6ncD&Q*MD&Q*MD&Q*MD&Q*MD&Q*MD&Q*MD&Q*cpQAwB*GyFw3Pbph z%6eQd=G#ZDEqetbzD9co>yP@H?B5i{7xwM3fAxlZdm?yAB0-ltVfu`R{s{do`mg9e zqJNWq3w?&3{?DnIdsbHgR{>W6R{>W6R{>W6R{>W6R{>W6R{>Xn7mNb8gnTTu^#z&8 zEny#uRJX6c6i$E7bIbbn%1bZFps&SSeTmQ8bW^~WrfOerqazf|@$KjNLpS<;hp3uY zm|EjLSQ@Cj`m{IZg|&gTS1RhACA8{z7#(jNAW$e=VN~w`yD98 z{c;s>6>t@B6>t@B6>t@B6>t@B71)IWZN~#1su_ibA)wLRteUHRsMvlGzqtpHJt%Z; zZehC4?$&PDy$^*t)!FH(*@-$tOBWDLD0F5{hoDq-fc>2SG@uX!^r^GA?ZvRS83ng7 z5kH0Bd>0^lP_T}Pcz0_ScJD*M`X*wcMFFA-1?!rKf&DT74Jf$PM7+06g1yZsP~SxS z3_jm10$3(olH3Pf%A%A@nG0}1d5KYKm*F+5LPXo|^{98@Ld)rd5w;B1iF%dt4 z-+Ty=J;+zbM7+DT9d_?SzWOF&qU9hEO~_Z*L=5b|9e@Vp+iD`-+jbl5ZARYuCfd*7 zHy;3G5Atp`(cazK2D|qmZ(S2@qNNpxCgiPWq7CeC0iXeSx0qNyK_K9XG^6?!+HV2v z_XDv9Z8gx|+v0=0`%qo`Y~V#+0Gd!e^X&cmDA?bCwpeHH#LxfVmK^ZV->09UKS_U^ z{vtdH@OJv==?~Cvre99$bT56GK2P6G-%dwqj&7no$!{b-mHg-Amy;h$zAO2Q$;Xqw znk*(Kk^{-5rQz*WFiz*WFiz*WFiz*WFiz*WFiz*XRdt3c9EHB;54tK(5W zwTH5osd^HAY9CculIo88sU~V|`Kc@7ry3}{)YNGoUR_ptv3Uh2$^T{|(hIClD6x70Ou>iE?T%UDuQ^yDwiip;{f(bLC{=_AK4%|)85XQiYE(04LSQF)+8pF=%!b&D^ljohD zNaLX%T(7`h&wD(P^qy)Z4UimuCd$=<->t#P*)tEfK=Ea&Tzp-MJvBPnGjn`?MlqL< zp6nUDdaZXw8#3jYA^F%yZ$G=zG1-f9Ggr@R^Z9yp=1|rae?y%)F3T!e78Um02o{{c zjj_+RU}13u|Eydy7vSe|-hiL7QSfg~rF;6Nvok`kadlSe?>>2)9g?OX{Lkdo>BWpS ze&yIPbL4dX=wyHADP>{iGK48ATef)})9yXcA`k#)y{oKQ#{_TkSdqp(xErs_V;YvB z^Jn@muZY5x>E$kMAainA3LXSf$pgT5f<%`lDeP zo$5GybbL^|JeSi%xHc!RT~$tw4_;b4Gkv^^J2x~q(J4)Atv3Xq!u8IgjaMva&WTwh z1^>x&HgY3Ad$~iXYE7%_S4Wn+yO+jK$b%Et<}X>Z1H(CWI5Tj3=+gA%ON-}*FO5#; zE-d$LYVAVE50yH)vDk8@%KZ%ftvSn5ueLnbeV&=>pX$!_T|RN@gxWDTeCgy^AKP{1 za!!~VnH-j9^>drfvL0ZoT)$0y3hF1I@OwP|LgS0Tnx^&fvCcI;ak7scUz%Q4de05# zI{0%JPRx(Vx-vJSo<4a&VEX%@i!JwR6C;D-)ZkVA=pf%QuvKcMwcM9Cw>`cd*Q0Ee zDH-?0Py<+Y$Q~T+E?*r9RrspWXmIBA)VWhe*P=e7Uoz%KPR%b}8(o}QoYc-D=g8J>y{H-aHyY*WeNK!a~domb4tYztRmCpo#3C8Y{*+=lMzF z{75D@gsu(clqEsxFlJ}f0poN}k2yEMpUYjn1ox3M{TGg(QwL@{2Tn76+U4G@)>L|B z%}Bt?c<5r;#GI!cJ_fPJDf=45y1;jhEfa;n&0uqxs;ak{x^iv;&5j&BH8UW0ofzjN z{_@b#^K)k|pE$m>z(b>6QBDrcj^_p@FLY?VbHhXR`&eb%;x=7FpeTb1Q6JcG(C%Nh z9n}$Z^B~%t?`0;K+@P?KQ^wEdx~$BlYZ>$EtUfh7F>va_&=44uvz9x%zTEYJOvN|%^rQ4f&=}kp( zc2S(kEpxjp>b_*PDBPZbJZl%ln(Q)LwB> z2bTuk)Elpsj$7BCCy)UTJ(~>0n|foLigJ>nY(l-FMxszuOXHq~ay$EQQX#<>6{6q? z5LI26S{CX`3uVHGsq2Gfx$=0^NMvi7e5Fht%H*e(`Q4To-dbk4OM;yU%0yG!cTD`D z?AB(9lbP>zi??`Xku}zL6vcL!?jwzd&0P@z>E&=5*wx#6O)(9KO3bf_-?T^ z#lE?1V_nKrrbf;lJ#%TGbN<};bVlo0=f7%)-pVt@B6>t@B75M2_AldEtpeF+Ho>3v8Lkx4)kOT-xE$W7D2@=d`brvFAYdQ~s znGt8`q9(COmLPbxiX);M5E|Mv8Iy$&;Ony;@F4B3zrO<;7+6f9n~EX0WngnCB|gy-fZkrj9q0*r5#yFg+Cz*J1;ArQVOLR#uypm3)Mi3|iFHw0)P9b)C15aJ%zokfF@Ap*Xk zzzIMGun-67hZ;brcg4hia=O7VDhEOKD@)KY17@@K)ArR(Fv~#YO>n-w_W6RMrgO5! zSkUay_?iLH)gg2^QjlqgnhA{!A{k&PM4#7GRY9s@@)871mmyv|Xjikg0Ox~8*Og7@ z!<#%F-*1)Ar&N=^Bd|CT^0cZkIgoxz4#)_f_!SEGDRRjoQF2SiG?m2|*w^-HC zO5VYwKCNeq-xtZ}ND&e{7%6uWJ^>x;JzVvKK%;0!VcL zQQV>7p}G(dA7b!}x~TFzR1t#j^Ke~5;C$I)ATqmRsVoHOuW3Ihympod^K!fi&Uaz$ ze6j)~0^}!94FMvpOA0T;=}Z>Fu``+}Xh`BA2E54$It1P~6=+M`k_wDEnh6VkHLEbN zf>g7{Q?4K01T(C^x6kL}HApqUsQ7wfIaP!F4-i-0&>^h^g#L#rY7mZIf{YQm0NoRs zlZBZ0&|%=xfbI*jssEujhZYheYq!_9K zsW~{V_H>K_Z-rDh*{8EN!Cmoh%C*x>oR~pYbiq1=iE zWH~(Av+xmKbwPE?)^MEw`2~{crNjWiN_MliNQpB{6`S=|9$aC z;xCPh@ks0|vG>P{v9VYx`h)0aqQ4PcjGl<@jr{M(Q;}beSP>->4?h$BVEC2c^I;); zW9YfiQ=zwoE{6s}2ZBEeej)g-;7YJR*b?}sz$XH~8n_%d5oq@Rv;S%Tulbk!ef~Dz zzxqDydxvkuH{?6${ek!M-gkRn<~`$0Q~yqVk@{~`fjUPWp?sdd#D>@XO5GQPH}D#e zVdl(5^CG;nzOb^f+rTq)D2v~D+YQyqFwDnY+kgE|VpL zc_oY3j6w`^N?Hc^Py?!@+Od=7Y|+AgR{DShXj20MWNvA3D+ABuifNIgIQ$4XIw0&= zoE>l@%@Y+T!=uIr(9XpH!yM*-Insa@%!#Qyyq|w@t=3!W0`F`>xMUXSM!UXKv-J>0 zIKb?DQh1hvzbHWFq3H~hIu7(kQjy*ynQ$DZR9YUIY16GnYP`)t;8^+WLn5!IrF03z|FgX z_mjg?W*<2$X7=s|ZX$<;_FDmNYk-HUrxv%m)^K6Ny#`0^Xm2Fp7`goxB2H-EL&UM| zH#>6zyo}P`K*Axh{U#!gX}^(#W99Z6h&ZvGCgS+^BoW89C!9HWH(gA}frDG<0z?a& zTc|U8DmO8>6HGcrh{BCIN{Y&<2%tO6-YVy3#8jA=43U!QAd#U=mJ!kcQj|~oiP1J6 zp!M$4cD?aSQ}O{XAaz}rD#Nx>xEPoo?!p0xXGmZoIGj{{MG8 z^mpJ-_sdnlRlrriRlrriRlrriRlrriRlrriRlrriRp4hq0h;o+cy3ge@VXs*=)sGX z=l_2eD(BY0RlrriRlrriRlrriRlrriRlrriRlrriRlrrCz5MGzW z;40uM;40uM;40uM;40uM;40uM;41J!RDg;{`kT?;pU!^odHyTk=%xSVB#WLn{jWd& z)Prw)_``oZ&iz&AyC3`3J1g(hZAc0LVfPt$y$wG*|1>V*K_PpZd554*IUwFwA_kaGE zKl@DEcVGLbZ@K@$`0-b4TLiC^pZ{O-&`U4Gc64oa6>t@B6>t@B6>t@B6>t@B6>t@B z6>t@B75FJupb)0Qo=AV8J&a!cMEC3)uG|s6`F*eb*dv{<``Twes@(nffrtKZ`g4c> z;#1d}rv5AC^|iNBZRcAbO}$~@*W<5?zn(o(ntokV=RI#c@pCuzJ^1WzKJl@^{>T3I zM+eTghOM_MulU1hMt}NSbASK&w_JPf;N8cjNzW&5Qxzl2Mj%nb2 zaU-6M-w^w|*psnGV`eNHqod!5J{f&obRv2zdQ;?^k>8KJ4)Xuq6}ch&jqvY77VWDOJE(o(NH#<%tl*$({&Noau=W#TlOnQJnaR5XA|g2vMB=i4euf zp9oQ$`iTS;Qw5y(i4etUp9oQ$^obC~DW3>YobZVd#p#|1QJn0F5XGsU2vMBqi4etU zo(NH#G>J)rnAC|$jhIx4$p?tZi-aVfdMPn^KPidl{}()8_t0OYe~W&Y9;MUC zA0@w#d{6Ra$&uut#19jnPrNJfU}89NF#dnypN+pWz7ijd-xm9R?9;Kg$F9WsV{Osz zML!k&_2^RcRJ0}XeB|lKW08F1WTZL#kKs>*-x8h)cZ3^5-wu5&^rp~s=$_Ec!T%Nf z{otcPBd7$EfoB6B4!kCy282KaX8*tKf5d;kpZCXnU-LcTd(=1Kdx>w4_uJl&d*AAv z^LBfisOPBvNxg}>M7@N%35+KE$`rA)wsSIK7}p`RgA5=0r;FHMbGQcp3yF}~bP+pj zq%8K>NLlQ%k+RrlBV$uVXQ$1s8qcSS&Q4nub#~gyC`uKbowhZ!y@;K*ZIjHF8w^;X zy@*{lA`m-lL?Cw8oI$?5h@CYD5M>3fy@*{kA`m-jL?Cw4oI$p|fW0(FkQdtv*hwP- zv5!UsVi(OBgxNQVhsFzd5xGF*qVaqdiRl87kA_(xT_AGO)>tAhZH*;z(}3laRDr}# z1C#}n#8F#ANj$YRl*CnALrHu!8%-Cmv*s{Dp)8N=X29+m5zD6w*kL1LQM!O#HX@cw z7qHVt#-<7+ZX0CmMX+c=;EI5IX>Ao1d$YWQ;m z5;txQCGq1h3TqrBj@%l0AJofnjwfX~=!o}{qePE9LaERZ#|cXX^gJO73Y;TH&yu5K za`YrQdV&yTQibE>Xb(Bs zO^$Yvqn+ev2RV8VIeIra`Vw;V7#WHkt{0P|cafu6a#SHlWkOUgfBydo5B;a~yXlAM z({y|C2g%PS-;unM>`S&Jo=-fTcr1}moJ{PGe>eUI@n4DO;@$E6vFBrd5_@Otq1b5b zaLgb5O7!vQBhm9wCK`%-CGy*mMHdY|)t z!uvLF-h0a1LOoACO+7~CsgqQ*=N~<9yxLYpotN9HsPlST8HH&$cGz~B?Aahv+Kbp*BLcCjMg(F% z%@O3_)YwZS0*Ei21SmX77iBKooxU^Wq76IV3Bd;q^tnt9VOwIgT*@u zI9@zhJVL^OeTNA+1m$H&I4JK90*-_7(j**|mm=U;(C-il2cMR;1Lts|L+1fMQAigL z?t;CYl;zXK+jhYoAZAm=Heh$YEFo|_d|t(-imikw+@@Q|(HD`U&7^3$xF1l*CS#N= z3vTPaU9fw1!8YxJy_J|v6&rzdYBH!A14H>O~ui8vEVYFT~WC3{U_6UGyW-H$HjAqk4DT$HbRHL9)2SHOJOZ6hNGds z34Jj1Na)@W6AA>s9DILpH8>u;Gw2KaMc}=GR|G}_DgO`spYy-df7RdbZ}mOz`y=1m ze3yO4efzxMh1vi5r~eu%P zJ7rbW*(ocdLb`;VGKawzSeSf@=@RzKNLlQgk+Rq`BVxf`?3aQJ8*<3 z_TNZQ7{IXm=7`##a+a|7Mu<8)Z!n=Km+I`i;W-8Tq)N`t+ZviKVdu@EWhETmfQQ=? z_TETY0{6`>7b)oyf%{fw<#dU_eJistG7-3MYiz27-M5|FtcY=sE-7N z#TDsL$qVR?j|btw5*~a^l_-)z`7AtfTJjL1#fM4Jbn)eYIu4h1)QfcSWxHS>B4$&? z2T9E3@J*w5jT~JeMGqIR0(ztY&6^7|>a01tc+oI(=AyajnJ&EYk`?&F#VfnOVL@Y= zz!3bpxtuC4k)nr-i{wVI(&1u$7r2-%E&%S>Ex>37KHs{$3wC}N>>MczYiF~&U}uO~ z{Q3W=m#&@v|5@@~$*ajz$^D7v5>F*wpD^I<|8V@v@%P3{@e6S_9*#W|`%vsPF(YY4FgZCre*Lqbi0z=)e zpQHk9tJqm<+!`{1<#2p07G+r`vx=Rx9T%8brWH^Qu6UGL#eNzg&1P1yt42tJCD>ad zr4OxQhpn*%<>n@)W?4?UlYwuxk`$wCGXpm*rhOIrYdd%<9K0$ApwPaGy)|c$Z(qf} z8WD&cHD?gDuVOFF8RXhmv5V#mvZ+<o|UUqmJ&{8Y-t(vAafM zETg1XvA;&jVuy{01skx-M#iRA9euWP)fkj2Ir?ntDE8SLn*k=zFk!FA|#5HJs%cGOnFURs?S1_WdT2A+N5`2!{Fnl;%smAR$GTA#BFAt_yQcE~Ubuib%t z*dg1w(aR{?Uc&y^PIU$l?rLIt2|HuXAWUPiC*})=s5LqVy5nN6h5eV(85`kdj10)~^eefa?2$gv$3CMzt_d9|x;IVL>+(!c9 zg^zoQK+y355eStTCj!|_={$ftx_fxkfo=walaeW&+ZBD5oR%}CF>+eUlt#&EF;hB2 zPV<@4$gb$qI-6e$afvc0=tPws*}u?zM%G5dc3GOmo%