Zaki
519e8fbd48
vault.db was tracked from the start of the repo, meaning every commit since the initial import has captured snapshots of the user's password data. Even though entries are AES-GCM encrypted in the DB, the file also contains: - PBKDF2 salt + hash of the master password (offline-crackable) - Audit log with timestamps + IP addresses - Session tokens (transient but historical) - Login attempt counters per username Future commits no longer include vault.db. The Delphi/PHP backend auto-creates the schema via CREATE TABLE IF NOT EXISTS on first run, so a fresh clone needs no migration step. Also ignore the SQLite sidecar files (-journal, -wal, -shm). NOTE: this only stops future leaks. The historical commits still contain old snapshots. Purging history requires git filter-repo + force-push, which rewrites every commit hash and breaks existing clones. See README for instructions if a history purge is desired.