Please DO NOT open a public issue for security vulnerabilities.

Instead, email: security@vaultine.dev with:

• Description of the vulnerability
• Affected versions
• Steps to reproduce
• Proof of concept (if available)

We will:

1. Confirm receipt within 24 hours
2. Investigate within 72 hours
3. Release a patch within 5 days
4. Credit the reporter (unless declined)

• ✅ Secrets at rest — AES-GCM-256 encryption with per-tenant KEK
• ✅ Multi-tenant isolation — independent KEK per user, no master key
• ✅ Integrity verification — AES-GCM authentication tags detect tampering
• ✅ Forward secrecy — KEK rotation re-encrypts all secrets
• ✅ Memory cleanup — secure_erase (volatile memset + compiler barrier)
• ✅ Anti-swap protection — secure_alloc/secure_buffer with mlock() prevents KEK from being paged to disk
• ✅ Password strength validation — configurable callback with default minimum length
• ✅ Detailed audit log — operation_target and details columns provide forensic context for every operation and error
• ✅ Atomic operations — KEK rotation uses single SQLite transaction

• ❌ Secrets in application memory — after decryption, plaintext is in the caller's buffer
• ❌ Root-level attacks — kernel compromise bypasses all software protections
• ❌ Weak passwords — security is rooted in password strength
• ❌ Side-channel attacks — OpenSSL AES is not guaranteed constant-time
• ❌ Physical attacks — JTAG, cold boot, memory probing

1. Use mlock() — prevent KEK from being swapped to disk (see secure_buffer)
2. Enforce password policy — ≥12 characters, 3+ character categories (lowercase, uppercase, digits, special)
3. Enable SELinux/AppArmor — confine the process
4. Monitor audit logs — watch for SSM_ERR_AUTH spikes
5. Rotate KEK periodically — every 90 days minimum
6. Use SQLCipher — enable encrypt-at-rest with a strong --db-key
7. Keep system patched — no secrets in kernel logs or core dumps

Uma auditoria interna de segurança foi concluída em junho de 2026, cobrindo todo o código-fonte (src/, cli/, tests/). Todos os 11 achados foram corrigidos (3 críticos, 4 altos, 4 médios). A auditoria focou em:

• Vazamento de material criptográfico na stack/heap
• Previsibilidade de caminhos de arquivos temporários
• Path traversal em operações de backup
• Exposição de senhas via command line (ps)
• Falta de autenticação no servidor REST
• Enumeração de usuários via timing/error codes
• Validação de entrada (username, permissões de config file)