thePR0M3TH3AN/SeedPass
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/SeedPass.git synced 2026-10-27 16:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,072 Commits 12 Branches 5 Tags
d34edd5ff30ed2a7f84ccb5babb25d15dcd2c51d
Commit Graph
56 Commits
Author SHA1 Message Date
thePR0M3TH3AN 9408a64c1c Merge pull request #921 from PR0M3TH3AN/fix-backup-seed-overwrite-3580566875642074998 
🔒 Fix Arbitrary File Overwrite in backup_parent_seed
 2026-02-26 14:34:32 -05:00
google-labs-jules[bot]andPR0M3TH3AN 39f552d589 Fix: Prevent arbitrary file overwrite in backup_parent_seed 
This change mitigates an arbitrary file overwrite vulnerability in the
`backup_parent_seed` API endpoint. Previously, the endpoint did not
check if the destination file already existed, allowing attackers or
accidental misuse to overwrite critical files if the path validation
passed.

The fix introduces a check using `resolved_path.exists()` after path
validation. If the file exists, the request is rejected with a
409 Conflict error.

A reproduction test case confirmed the vulnerability and verified the
fix. Regression tests on the API passed successfully.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-26 19:09:06 +00:00
google-labs-jules[bot]andPR0M3TH3AN cf9d473abe perf: offload blocking import_vault operations to thread 
Refactors `import_vault` endpoint in `src/seedpass/api.py` to use `asyncio.to_thread` for blocking file I/O and synchronous `PasswordManager.handle_import_database` calls.
Replaces synchronous `pm.sync_vault()` with `await pm.sync_vault_async()` (with fallback) to prevent blocking the event loop or triggering `asyncio.run` errors.

This change ensures the API remains responsive during large vault imports.
Verified with a custom benchmark script showing concurrent requests are no longer blocked.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-26 17:48:27 +00:00
thePR0M3TH3AN 72e6e3ba38 Close security item 6 with unlock throttling and policy gates 2026-02-25 18:32:06 -05:00
thePR0M3TH3AN 73a175b93f Harden item 6 API route access controls while locked 2026-02-25 18:29:02 -05:00
thePR0M3TH3AN dd6cbea7de Start security item 6: API lock access control and unlock route 2026-02-25 18:26:43 -05:00
thePR0M3TH3AN 56b68bd0ac Complete security item 3 hardening and redaction sweep 2026-02-25 18:23:40 -05:00
google-labs-jules[bot]andPR0M3TH3AN 4a1529fd1a Fix CI failures: linting and dependency vulnerabilities 
- Apply code formatting fixes (black) to resolve test workflow failures.
- Update `pyproject.toml`, `src/requirements.txt`, and lock files to upgrade vulnerable dependencies:
  - aiohttp -> 3.13.3
  - cryptography -> 46.0.5
  - orjson -> 3.11.7 (CVE-2025-67221)
  - pillow -> 12.1.1 (CVE-2026-25990)
  - pynacl -> 1.6.2 (CVE-2025-69277)
  - starlette -> 0.52.1 (CVE-2025-62727)
  - urllib3 -> 2.6.3 (CVE-2025-66418, etc.)
  - cbor2 -> 5.8.0 (CVE-2025-68131)
  - pyasn1 -> 0.6.2 (CVE-2026-23490)
  - python-multipart -> 0.0.22 (CVE-2026-24486)
- Manually sync `requirements.lock` from `poetry.lock` as `pip-compile` is unavailable in the environment.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-25 19:24:01 +00:00
thePR0M3TH3AN 3ea37865cb Add landing install copy UX and document remaining security/test TODOs 2026-02-23 16:33:57 -05:00
thePR0M3TH3AN 0789dfcb55 Harden agent policy and API import limits; fix docs links 2026-02-23 16:24:53 -05:00
google-labs-jules[bot]andPR0M3TH3AN 8e33f9c5e1 Fix formatting, linting, and logic errors from codebase scan 
- Apply black formatting to 17 files.
- Fix F821 undefined name errors in:
  - src/main.py: Add missing `queue` import.
  - src/seedpass/core/encryption.py: Fix `JSONDecodeError` reference.
  - src/utils/__init__.py: Fix exception variable scope in fallback code.
  - src/utils/key_derivation.py: Add `TYPE_CHECKING` imports.
  - src/seedpass/core/config_manager.py: Add `TYPE_CHECKING` imports.
- Initialize torch environment and TODO file.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 18:09:48 +00:00
thePR0M3TH3AN d99af30d9f Switch API token to bcrypt 2025-08-20 19:29:08 -04:00
thePR0M3TH3AN 619226d336 feat: support random and deterministic TOTP secrets 2025-08-20 18:36:19 -04:00
thePR0M3TH3AN b97d60778b Restore compatibility for key hierarchy 2025-08-20 18:12:02 -04:00
thePR0M3TH3AN bbb26ca55a test: add key hierarchy tests 2025-08-20 17:57:50 -04:00
thePR0M3TH3AN 468608a369 Support listing all entry types 2025-08-18 19:12:55 -04:00
thePR0M3TH3AN dc7673c7e0 Refactor API endpoints to async 2025-08-05 20:03:56 -04:00
thePR0M3TH3AN 181f486afb Add test for relay reload logging 2025-08-05 19:46:14 -04:00
thePR0M3TH3AN 20ee8a891b refactor: move api state to app 2025-08-05 19:14:11 -04:00
thePR0M3TH3AN f0f7aee9e6 Merge pull request #735 from PR0M3TH3AN/codex/validate-path-argument-in-import-handler 
Validate vault import path and extension
 2025-08-03 14:32:43 -04:00
thePR0M3TH3AN 77c4c33818 Validate import path and extension 2025-08-03 14:15:46 -04:00
thePR0M3TH3AN 3a19ef9c2a require password for sensitive read endpoints 2025-08-03 14:12:24 -04:00
thePR0M3TH3AN 3dc10ae448 Use constant-time token comparison 2025-08-03 12:39:43 -04:00
thePR0M3TH3AN 9d9f8a8bae Hash JWT token in API 2025-08-03 08:50:57 -04:00
thePR0M3TH3AN e5f1158101 Test API rate limiting 2025-08-03 08:41:22 -04:00
thePR0M3TH3AN f1bf65385c Validate encryption paths and block traversal 2025-08-03 07:54:07 -04:00
thePR0M3TH3AN 7aeba78245 Remove insecure parent seed endpoint 2025-08-02 22:01:38 -04:00
thePR0M3TH3AN 186e39cc91 feat: add short-lived JWT auth and secure endpoints 2025-08-02 21:48:52 -04:00
thePR0M3TH3AN dcd095d1af Include entry type in search results 2025-08-02 16:26:52 -04:00
thePR0M3TH3AN cc8fba9f12 Add key validation utilities and integrate 2025-08-01 10:38:40 -04:00
thePR0M3TH3AN 6d6a284096 Add password policy options to API 2025-07-30 21:23:18 -04:00
thePR0M3TH3AN 627d69cf30 Add edit options for key/value entries 2025-07-30 16:51:53 -04:00
thePR0M3TH3AN 4a20817094 Add key field to key/value entries 2025-07-28 15:04:56 -04:00
thePR0M3TH3AN 8bd9a75629 Parametrize password actions 2025-07-17 19:38:28 -04:00
thePR0M3TH3AN c23b2e4913 Refactor password manager modules 2025-07-17 19:21:10 -04:00
thePR0M3TH3AN d87d9ed59f Add notifications API endpoint 2025-07-14 11:43:09 -04:00
thePR0M3TH3AN f5dcaf9af4 Add quick unlock config option 2025-07-13 14:59:22 -04:00
thePR0M3TH3AN b52d027ec7 Validate entry type fields 2025-07-12 13:03:39 -04:00
thePR0M3TH3AN 8414ee53c6 Trigger vault sync after imports 2025-07-11 20:06:05 -04:00
thePR0M3TH3AN afefb5415b cli: avoid fingerprint prompt when option provided 2025-07-11 14:19:16 -04:00
thePR0M3TH3AN 39ec8026db Add vault export and relay management API 2025-07-09 21:21:29 -04:00
thePR0M3TH3AN 19e7ac18ca Add secret mode toggle command and API 2025-07-09 20:40:44 -04:00
thePR0M3TH3AN ce8281c80f Add vault stats command and API endpoint 2025-07-09 20:10:43 -04:00
thePR0M3TH3AN cc521dde76 Add vault locking command and API 2025-07-09 20:02:06 -04:00
thePR0M3TH3AN a0e2d227a5 Add parent seed backup command and API 2025-07-09 19:53:10 -04:00
thePR0M3TH3AN ecc1086d47 Add totp codes command and endpoint 2025-07-09 17:21:35 -04:00
thePR0M3TH3AN 4f810ccbc3 Add TOTP export via CLI and API 2025-07-09 17:09:27 -04:00
thePR0M3TH3AN 068611a02c Add vault import support 2025-07-09 16:45:32 -04:00
thePR0M3TH3AN a79f3c8905 Add checksum CLI and API utilities 2025-07-09 15:54:26 -04:00
thePR0M3TH3AN e2235b61e1 Add change-password command and endpoint 2025-07-09 15:46:37 -04:00