fix!: harden the vault against injection, silent data loss, and weak keys - #18

Merged

jahvon merged 7 commits into

mainfrom

feat/harden-v0.3.0

Jul 26, 2026

Commits on Jul 26, 2026

fix(external)!: stop routing secret values through the shell

jahvon
and
claude
committed
a17633e
fix(local)!: stop losing secrets on empty files and concurrent writes

jahvon
and
claude
committed
3ee8ac6
fix(crypto)!: reject weak keys and stop deriving unsalted KEKs

jahvon
and
claude
committed
4065d14
fix: validate vault IDs, namespace keyring entries, repair path expansion

jahvon
and
claude
committed
9878c94
fix: order-independent options, version gating, and honest secret clearing

jahvon
and
claude
committed
31e7403
fix(examples): make the shipped provider configs work and keep them tested

jahvon
and
claude
committed
c7d9f3b
docs: document the v0.3.0 breaking changes and the stdin rule

jahvon
and
claude
committed
bf94f1f