r-zakarya 71f45eb8e1 fix(kdf): disable the data-loss KDF auto-migration path (audit 6c-1) ...

/migrate-kdf changed the AES key (100k->600k) but only re-encrypted
encrypted_password, leaving totp_secret/custom_fields/*_enc + attachments
under the old key = permanent data loss. Both live accounts are already at
600k so it never fired, but the path was armed and auto-triggered by the
server's login signal.

Removed the two triggers (doLogin + unlock) and the now-dead runKdfMigration.
Legacy <600k accounts upgrade safely via Change Master Password instead
(re-encrypts everything + moves to Argon2id). The Delphi endpoint is left
inert: without the client orchestrating the key swap it can't corrupt
anything, so no untested server change. Closes 6c-4 too (unreachable now).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-20 05:20:07 +01:00

css

style(list): align the password column across rows

2026-07-13 21:58:46 +01:00

delphi-backend

fix(sync): preserve created_at/updated_at when sync adds a remote entry

2026-07-13 00:18:13 +01:00

js

fix(kdf): disable the data-loss KDF auto-migration path (audit 6c-1)

2026-07-20 05:20:07 +01:00

.gitattributes

feat: secure notes + password history + custom fields + quick-win bundle

2026-06-14 20:17:19 +01:00

.gitignore

chore: stop tracking generated embedded-asset artifacts

2026-07-11 18:35:28 +01:00

api.php

Add CSP header and session rotation on login

2026-05-09 22:24:08 +01:00

CLAUDE.md

refactor(db): drop cleartext template refs, fix ghost columns + fresh-DB schema

2026-07-11 19:52:26 +01:00

CODE_AUDIT.md

fix(kdf): disable the data-loss KDF auto-migration path (audit 6c-1)

2026-07-20 05:20:07 +01:00

icon-hex-16.svg

feat: MFA tools, single-instance, tray polish, prefs persistence

2026-06-08 21:31:39 +01:00

icon-hex.svg

feat: MFA tools, single-instance, tray polish, prefs persistence

2026-06-08 21:31:39 +01:00

icon-key.svg

feat: MFA tools, single-instance, tray polish, prefs persistence

2026-06-08 21:31:39 +01:00

icon-shield.svg

feat: MFA tools, single-instance, tray polish, prefs persistence

2026-06-08 21:31:39 +01:00

icon-vault.svg

feat: MFA tools, single-instance, tray polish, prefs persistence

2026-06-08 21:31:39 +01:00

icon.svg

feat: MFA tools, single-instance, tray polish, prefs persistence

2026-06-08 21:31:39 +01:00

index.html

feat(security): "Lock vault when Windows locks or sleeps" toggle (default ON)

2026-07-13 05:17:16 +01:00

package.json

test: add frontend unit suite + fix mixed local/UTC timestamps

2026-07-04 19:17:33 +01:00

security-issues.md

Mark resolved issues in security-issues.md

2026-05-09 22:29:09 +01:00

test_pbkdf2.php

feat: MFA tools, single-instance, tray polish, prefs persistence

2026-06-08 21:31:39 +01:00

TEST_PLAN.md

feat: PIN unlock + table column picker + edit-position chooser + UX

2026-06-29 04:41:39 +01:00

TEST_REGRESSION.md

feat: sticky slideover Save + uncategorised-view polish + regression plan

2026-07-01 13:04:45 +01:00

TEST_SYNC.md

feat: WebDAV sync + batch DnD + clean shutdown + center-modal UX bundle

2026-06-30 00:32:12 +01:00

S

Description

full local password manager

24 MiB

Languages

Pascal 46.7%

JavaScript 35.4%

HTML 9.4%

CSS 4.9%

PHP 2.1%

Other 1.4%