Vault and Authentication Integrity Hardening
Web AppSecurityVault
Made vault rotations atomic, strengthened custom-key derivation, closed authentication enumeration, and limited anonymous CLI handshakes.
#Vault and Authentication Integrity Hardening
This release brings crucial security and integrity hardening across our vault storage and authentication boundaries.
Important
Vault rotations are now fully atomic. If any failure occurs during a rotation, keys will never be left in an inconsistent or partially-encrypted state.
#Security & Cryptographic Hardening
- Atomic Vault Rotations: Vault ciphertext and encryption metadata now change in a single database transaction.
- Salted Memory-Hard Derivation: New and rotated custom vault keys utilize salted key derivation while existing vaults remain readable.
- Unified Session Revocation: Password resets immediately revoke active browser sessions, CLI tokens, and MCP OAuth authorizations.
- Rate-Limited Anonymous Handshakes: Hardened MFA discovery and added strict rate limits to anonymous CLI connection requests.