Skip to content

SECURITY.md

Latest commit

 

History

History
259 lines (190 loc) · 10.6 KB

SECURITY.md

File metadata and controls

259 lines (190 loc) · 10.6 KB
Raw

Security Policy

🔒 Aegis Vault Security

Aegis Vault is a zero-knowledge password manager with a strong focus on security. We take security vulnerabilities seriously and appreciate responsible disclosure.

📄 Technical Documentation

️ v2.0.1 Security Update (January 13, 2026)

✅ Hardened Edition Release

Status: IMPLEMENTED

Major Security Improvements:

  • Memory Page Locking: Integrated VirtualLock (Windows API) via native C++ addon to prevent sensitive data from leaking to the disk (Pagefile/Swap).
  • Hardware Binding: Implemented machine-specific secret generation using Windows DPAPI. The database key is now cryptographically bound to the physical hardware.
  • Attack Surface Reduction: Completely removed named pipe server (\\.\\pipe\\aegis-vault-pipe) to eliminate potential IPC attack vectors.
  • Code Obfuscation: Professional-grade obfuscation applied to all critical logic.

Security Score Impact:

  • Platform Security: 85/100 → 98/100 (+13)
  • Overall Security: 92/100 → 98/100 (+6)
  • Total Score: 98/100 (A++ Grade)

Detailed Changes:

  1. Named Pipe Removal: The browser extension support was removed to close a high-priority attack surface.
  2. Memory Protection: Keys are now pinned in RAM to prevent swapping.
  3. Hardware Binding: Vaults are now bound to the specific machine's hardware ID.

📊 Current Security Status

  • Security Score: 98/100 (A++ Grade)
  • Last Audit: January 14, 2026
  • Version: 2.0.1
  • Encryption: AES-256-GCM (NIST-approved)
  • KDF: Argon2id (20 iterations, 64MB RAM)
  • Hardware Binding: ACTIVE (Machine Bound)
  • Memory Protection: ACTIVE (VirtualLock)

🛡️ Supported Versions

We provide security updates for the following versions:

Version Supported Security Score
2.0.x ✅ 98/100
1.1.x ✅ 92/100
1.0.x ✅ 85/100
< 1.0 ❌ N/A

Recommendation: Always use the latest version for maximum security.

🚨 Reporting a Vulnerability

If you discover a security vulnerability in Aegis Vault, please help us by following responsible disclosure practices:

⚠️ DO NOT:

  • ❌ Open a public GitHub issue
  • ❌ Post the vulnerability on social media
  • ❌ Share exploit code publicly before we've patched

✅ DO:

  1. Email us privately: security@hetech-me.space (or sales@hetech-me.space with "SECURITY" in subject)

  2. Include the following information:

    • Type of vulnerability (e.g., brute-force bypass, encryption weakness, memory leak)
    • Affected version(s)
    • Steps to reproduce
    • Proof of concept (if applicable)
    • Suggested fix (optional)
    • Your name/handle for acknowledgment (optional)

  3. Wait for our response - We aim to respond within 48 hours

🕐 Our Process

  1. Acknowledgment (48 hours): We confirm receipt of your report
  2. Validation (1-7 days): We verify the vulnerability
  3. Fix Development (1-14 days): We develop and test a patch
  4. Coordinated Disclosure (variable): We coordinate release timing with you
  5. Public Disclosure: We release the patch and credit you (if desired)

🏆 Recognition

We believe in recognizing security researchers who help make Aegis Vault safer:

  • Hall of Fame: Your name listed in SECURITY.md (with your permission)
  • CVE Assignment: For critical vulnerabilities
  • Early Access: Beta access to new security features
  • Public Credit: Acknowledgment in release notes

🔐 Security Features

Aegis Vault implements multiple layers of security:

Cryptography

  • Encryption: AES-256-GCM with authenticated encryption
  • Key Derivation: Argon2id (OWASP 2024 compliant)
  • Random Number Generation: Cryptographically secure (Web Crypto API)
  • Password Hashing: zxcvbn strength analysis + policy enforcement

Access Control

  • Master Password Policy: Enforced 12+ character minimum

Recommendation: Always use the latest version for maximum security.

🚨 Reporting a Vulnerability

If you discover a security vulnerability in Aegis Vault, please help us by following responsible disclosure practices:

⚠️ DO NOT:

  • ❌ Open a public GitHub issue
  • ❌ Post the vulnerability on social media
  • ❌ Share exploit code publicly before we've patched

✅ DO:

  1. Email us privately: security@hetech-me.space (or sales@hetech-me.space with "SECURITY" in subject)

  2. Include the following information:

    • Type of vulnerability (e.g., brute-force bypass, encryption weakness, memory leak)
    • Affected version(s)
    • Steps to reproduce
    • Proof of concept (if applicable)
    • Suggested fix (optional)
    • Your name/handle for acknowledgment (optional)

  3. Wait for our response - We aim to respond within 48 hours

🕐 Our Process

  1. Acknowledgment (48 hours): We confirm receipt of your report
  2. Validation (1-7 days): We verify the vulnerability
  3. Fix Development (1-14 days): We develop and test a patch
  4. Coordinated Disclosure (variable): We coordinate release timing with you
  5. Public Disclosure: We release the patch and credit you (if desired)

🏆 Recognition

We believe in recognizing security researchers who help make Aegis Vault safer:

  • Hall of Fame: Your name listed in SECURITY.md (with your permission)
  • CVE Assignment: For critical vulnerabilities
  • Early Access: Beta access to new security features
  • Public Credit: Acknowledgment in release notes

🔐 Security Features

Aegis Vault implements multiple layers of security:

Cryptography

  • Encryption: AES-256-GCM with authenticated encryption
  • Key Derivation: Argon2id (OWASP 2024 compliant)
  • Random Number Generation: Cryptographically secure (Web Crypto API)
  • Password Hashing: zxcvbn strength analysis + policy enforcement

Access Control

  • Master Password Policy: Enforced 12+ character minimum
  • Brute-Force Protection: Progressive lockout (3→30s, 5→5min, 10→30min)
  • Persistent Lockout: Survives application restarts
  • 2FA Support: TOTP-based two-factor authentication
  • Biometric: Windows Hello / TouchID (OS-level secure storage)

Data Protection

  • Zero-Knowledge: Master key never leaves your device
  • Hardware Bound: Data tied to physical machine identity
  • Granular Encryption: Each entry encrypted separately with unique IV
  • Memory Protection: Native VirtualLock + Triple-wipe on lock
  • Audit Logging: AES-256-GCM encrypted logs
  • Recovery System: BIP39 24-word phrase with Argon2id

Attack Mitigation

  • ✅ Brute-Force: Persistent lockout protection
  • ✅ Memory Dump: VirtualLock memory pinning + Triple-wipe
  • ✅ Offline Attack: High-iteration Argon2id (20+) + Hardware-specific salt
  • ✅ Weak Password: Enforced policy + zxcvbn analysis
  • ✅ Tampering: Full code obfuscation + integrity checks
  • ✅ MITM Updates: Signature verification configured
  • ✅ Named Pipe Attack: Completely eliminated
  • ✅ Privilege Escalation: No extension pipe vector
  • ✅ Cold Boot Protection: Encrypted RAM pages (VirtualLock)
  • ⚠️ Keylogger: Out of scope (OS-level protection needed)

🔍 Security Audit History

Date Version Type Auditor Score Report
2026-01-14 v2.0.1 Full Audit Internal 98/100 View Technical Report
2026-01-11 v2.0.0 Full Audit Internal 96/100 View Report
2026-01-08 v1.1.1 Full Audit Internal 93/100 View Report
2025-12-20 v1.0.0 Internal Review Aegis Team 85/100 Initial release

🛠️ Security Best Practices for Users

To maximize your security when using Aegis Vault:

✅ DO:

  • Use a strong, unique master password (12+ characters)
  • Enable OS-level disk encryption (BitLocker/FileVault/LUKS)
  • Save your 24-word recovery phrase in a secure offline location
  • Enable 2FA if you share your device
  • Keep Aegis Vault updated to the latest version
  • Use biometric unlock for convenience (still requires master password first-time)
  • Review security audit logs periodically

❌ DON'T:

  • Reuse your master password anywhere else
  • Store your master password in another password manager
  • Share your recovery phrase digitally (email, cloud, etc.)
  • Run Aegis Vault on an infected/untrusted system
  • Install from unofficial sources
  • Disable security features for convenience

📚 Security Resources

🏅 Security Hall of Fame

We thank the following security researchers for their responsible disclosure:

Researcher Vulnerability Severity Date Bounty
Awaiting first report - - - -

Your name could be here! Report responsibly.

📞 Contact

🔄 Update Policy

  • Critical Security Updates: Released immediately
  • High Severity: Released within 7 days
  • Medium Severity: Released within 30 days
  • Low Severity: Released in next minor version

All security updates are free and automatic (with user consent).

Last Updated: January 14, 2026 Next Audit: Scheduled for Q2 2026

Aegis Vault - Security is not optional, it's fundamental.

📚 For detailed technical specifications and security architecture, please refer to our comprehensive Technical Security Architecture Whitepaper (English) / Teknik Güvenlik Mimarisi Raporu (Türkçe).