Aegis Vault

Next-Generation Zero-Knowledge Password Manager

Offline-first, end-to-end encrypted credential management for Desktop, Browser & CLI.

Trust & Security Documentation

Aegis Vault ships with a dedicated trust documentation set for security review, GitHub visitors, and release preparation:

Document	Scope
SECURITY.md	Security policy, supported versions, reporting, and quality gates
THREAT_MODEL.md	Threat model, trust boundaries, attacker assumptions, and residual risks
BACKUP_RECOVERY.md	Encrypted backup, restore, QR sync, import/export, and recovery handling
CRYPTO_VAULT_SECURITY.md	Crypto Vault + watch-only custody model and non-signing guarantees
PRIVACY_MODEL.md	Local-first privacy, HIBP, aliases, extension privacy, and sync exposure
docs/TRUST_CENTER.md	Trust center index for release evidence, audit readiness, and protocol docs

Crypto Vault + Watch-Only Custody

Aegis Vault 5.0 now includes a dedicated Crypto Vault domain for offline-first crypto asset records:

• Watch-only by default - Store public receive addresses without enabling live signing or transaction broadcast
• Encrypted secret custody - Optionally store seed phrases or private keys inside the encrypted vault when explicitly selected
• Network-aware validation - Bitcoin, Ethereum/EVM, Solana, Tron, Litecoin and custom address formats are checked before saving
• Risk-aware UX - Seed/private key mode shows explicit recovery and backup warnings in both dark and light modes
• Backup-safe records - Crypto wallet metadata, derivation path, manual balance, notes and secret material are preserved across encrypted backups, JSON import/export, QR sync and canonical migration
• Mutation quality gate - Crypto wallet domain tests must stay above the 80% Stryker threshold

---

✨ What's New in 5.0

Aegis Vault 5.0 is a major milestone — a ground-up evolution of security architecture, privacy tooling, and user experience.

🛡️ Security Center 2.0 & Automated Triage

The Security Center has been transformed from a passive reporting dashboard into an active remediation engine:

• Focused Triage Mode — Step-through wizard for systematically resolving security issues by severity
• Automated Alias Rotation — One-click API-driven rotation for compromised or exposed email aliases
• 8 Security Metrics — Missing 2FA, passkey readiness, aging credentials, sharing gaps, alias exposure, alias rotation, device trust, local risk
• Review History & Trend Analytics — 7-day activity windows with reviewed/reopened/auto-resolved tracking
• Bulk Recommendations Engine — Context-aware suggestions based on current vault state

🎭 Alias Privacy System

A complete masked email management platform built directly into the vault:

• Quick Alias Modal — Generate privacy-preserving email aliases in seconds
• Multi-Provider Support — SimpleLogin, Addy.io, Firefox Relay, Apple Hide My Email, plus custom providers
• API-Driven Provisioning — Direct integration with alias provider APIs for real-time alias creation
• Watchtower Risk Scoring — Per-alias risk evaluation with exposure tracking and rotation recommendations
• Alias Identity Panel — Full provider profile management with sync status, domain configuration, and audit trail

☁️ Sync Relay

End-to-end encrypted cross-device vault synchronization:

• Push/Pull Architecture — Manual encrypted sync with sequence-based conflict tracking
• Self-Hosted Relay — Deploy your own HTTPS-only relay server for full sovereignty
• Session Management — UUID-based sessions with regeneration and device pairing
• Zero-Knowledge Transport — All data encrypted client-side before relay transmission

🎨 V5 Design System

Premium, production-grade UI overhaul:

• Glassmorphism & Micro-Animations — Framer Motion-powered transitions throughout
• Dark Mode (Full) — Pixel-perfect dark theme with high-contrast accessibility
• Geist Typography — Inter/Geist Sans/Geist Mono font stack for professional legibility
• Adaptive Layout — Responsive from mobile to ultra-wide with view density controls (compact/comfortable)
• Clipboard Timeline — Visual countdown for auto-sanitizing copied credentials

---

🏗️ Architecture

Aegis Vault 5.0
├── Desktop App          Electron 40 + React 19 + Vite 7
├── Browser Extension    Chrome / Firefox / Safari (WXT framework)
├── CLI                  Node.js — bilingual TR/EN interface
├── Sync Relay           Self-hosted HTTPS-only encrypted relay
└── Native Host Bridge   Desktop ↔ Extension secure pairing

Cryptographic Stack

Layer	Implementation
Key Derivation	Argon2id (Web Worker + WASM fallback)
Encryption	AES-256-GCM with per-field IV management
Vault Storage	SQLCipher (WASM) with OPFS / IDB fallback
Backup Integrity	HMAC-SHA256 envelope verification
Sync Transport	ECDH + AES-GCM end-to-end encryption
Crypto Vault	Watch-only records + encrypted seed/private key custody
Sharing Transport	ECDH receiver pairing + replay protection
Release Signing	Ed25519 manifest + trust chain verification
Biometric Unlock	WebAuthn (device-bound credentials)

Modular Vault Architecture

The vault core is decomposed into 9 dedicated service modules under src/lib/vault/:

Service	Responsibility
VaultAuthService	Authentication, key derivation, legacy salt fallback
VaultBootstrapService	Database initialization, IDB→SQLite migration
VaultCryptoService	Field-level AES-256-GCM encryption/decryption
VaultEntryService	CRUD operations for all vault entry types
VaultPinService	PIN-based quick unlock with Argon2id verification
VaultSearchIndexer	Encrypted search index build and lazy migration
VaultStorageService	Low-level storage abstraction (SQLCipher/IDB)
VaultTrashService	Soft-delete, restore, auto-cleanup (30-day policy)
VaultAttachmentService	File attachment encryption, storage, and retrieval

---

🔐 Key Features

Feature	Description
Zero-Knowledge Architecture	All encryption/decryption happens client-side; no plaintext ever leaves device
Offline-First Vault	Full functionality without network; encrypted local SQLite storage
Security Center 2.0	Active triage engine with automated remediation and 8 security metrics
Alias Privacy System	Masked email generation, provider API integration, watchtower risk scoring
Crypto Vault + Watch-Only	Offline crypto asset records with watch-only default and encrypted secret mode
Sync Relay	E2E encrypted cross-device sync with self-hosted relay option
Emergency Access	Trusted contacts, configurable wait windows, grant TTL, full audit trail
Special Entry Types	Logins, credit cards, identity cards, passkeys, TOTP, secure notes
QR Sync	Encrypted credential transfer via QR codes with one-time-use enforcement
Sharing Transport	E2E encrypted entry sharing with ECDH receiver pairing & replay protection
Bilingual (TR/EN)	Complete Turkish/English support across UI, CLI, and documentation
Argon2 Web Worker	Non-blocking key derivation with automatic WASM/main-thread fallback
Release Trust Chain	SBOM generation, Ed25519 signing, provenance verification
Passkey Governance	Site inventory, WebAuthn binding, credential lifecycle management
Watchtower	Breach monitoring (HIBP), credential age alerts, security score gauge
Dark Mode	Full dark theme with high-contrast accessibility compliance

---

📊 Test Coverage

Metric	Score
Test Files	108+
Unit Tests	891+ (all passing)
E2E Tests	189 (16 spec files)
Statements	87.36%
Branches	75.4%
Functions	90.6%
Lines	89.43%
Mutation Resilience	83.88% (Stryker gate)
Crypto Vault Mutation Gate	83.67% (80% break threshold)

Mutation Resilience (Security Services)

Service Category	Mutation Score
Recovery Drill	97.00%
Crypto Vault Domain	83.67%
WebAuthn Service	81.71%
WebAuthn PRF Utilities	76.67%
Mutation Gate Composite	83.88%

The default mutation gate focuses on deterministic security/domain modules that are suitable for Vitest mutation testing. The extended profile keeps the broad historical report shape by including legacy module families, Android-side security modules, storage/facade modules such as SQLite OPFS persistence and the VaultService orchestrator. The extended profile is diagnostic and does not block the release gate.

# Run unit tests
npm run test

# Run with coverage
npm run test:coverage

# Run E2E tests
npm run test:e2e

# Run mutation tests
npm run test:mutate

# Run crypto vault mutation quality gate
npm run test:mutate:crypto

# Run extended exploratory mutation analysis
npm run test:mutate:extended

# Full CI quality gate (lint + unit + regression + e2e)
npm run test:quality-gate

---

🔒 Code Quality

• ESLint: Zero errors, zero warnings across the entire codebase
• TypeScript Strict: Full strict mode enabled (TS 5.9)
• Mutation Testing: Stryker integration for test quality validation
• Crypto Vault Gate: npm run test:mutate:crypto fails if crypto domain mutation score drops below 80%
• E2E Resilience: Playwright-based suite with toPass assertions and async state sync
• CI Quality Gate: npm run test:quality-gate enforces lint + unit + regression + e2e
• Static Analysis: CodeQL and Semgrep in CI for automated vulnerability scanning

---

🚀 Quick Start

Requirements

• Node.js 20+
• npm 10+

Install

git clone https://github.com/hafgit99/AegisVault_V.4.0.0.git
cd aegis-4.0
npm install
npm --prefix aegis-wxt install

Run

# Web UI (development)
npm run dev

# Desktop (Electron)
npm run start:electron

# Browser extension (development)
npm --prefix aegis-wxt run dev

Build

# Web production build
npm run build

# Electron package
npm run build:electron

# Browser extension
npm run build:extension

---

💻 CLI (TR/EN)

Bilingual command-line interface for automation and operational workflows.

npm run cli -- help
npm run cli -- status --lang tr
npm run cli -- list --limit 25
npm run cli -- export --format json

Resource	Link
Turkish Guide	CLI Kullanım Kılavuzu
English Guide	CLI Usage Guide
CLI Index	docs/CLI/README.md

---

📜 Scripts Reference

Command	Description
npm run dev	Start Vite dev server
npm run build	TypeScript check + Vite production build
npm run lint	ESLint (zero errors enforced)
npm run test	Run all unit tests
npm run test:coverage	Tests with v8 coverage report
npm run test:e2e	Playwright end-to-end tests
npm run test:quality-gate	Full CI quality gate (lint + unit + regression + e2e)
npm run test:mutate	Stryker mutation gate for deterministic security core
npm run test:mutate:extended	Extended exploratory mutation analysis
npm run test:mutate:crypto	Crypto Vault mutation gate, break threshold 80%
npm run format	Prettier code formatting
npm run release:trust-chain	SBOM + provenance + signing + verification
npm run cli	Aegis CLI interface

---

🛡️ Security & Governance

Resource	Language
Security Policy	EN
Threat Model	EN
Security Whitepaper	EN
Audit Application Pack	EN
OSS-Fuzz Application Notes	EN
Incident Response	EN
Hardening Plan	TR
Release Verification Guide	TR
Competitor Analysis	EN
Security Roadmap	TR

---

📁 Project Structure

aegis-4.0/
├── src/
│   ├── components/
│   │   ├── dashboard/          # Main dashboard panels (22 components)
│   │   │   ├── SecurityCenterPanel    # Security Center 2.0 with triage engine
│   │   │   ├── QuickAliasModal        # Quick alias generation wizard
│   │   │   ├── SyncRelayControl       # Sync relay push/pull controls
│   │   │   ├── AliasPrivacyPanel      # Alias privacy management
│   │   │   ├── EmergencyAccessPanel   # Emergency access controls
│   │   │   ├── ReleaseTrustPanel      # Release trust chain viewer
│   │   │   └── ...                    # Entry forms, sharing, watchtower, etc.
│   │   ├── onboarding/         # Setup wizard
│   │   ├── settings/           # Settings drawers, alias identity panel
│   │   └── ui/                 # Shared UI primitives
│   ├── config/                 # Encryption profiles, security settings, sync strategy
│   ├── contexts/               # React context providers (VaultContext)
│   ├── hooks/                  # Custom hooks (useVaultData, useVaultSecurity, etc.)
│   ├── lib/                    # Core business logic (48 modules)
│   │   ├── vault/              # Modular vault services (9 services)
│   │   ├── AliasProviderService        # Multi-provider alias management
│   │   ├── SecurityCenterService       # Security scoring & triage engine
│   │   ├── SharingTransportService     # E2E encrypted sharing
│   │   ├── SyncManager                 # Relay sync orchestration
│   │   ├── EmergencyAccessService      # Emergency access lifecycle
│   │   └── ...                         # Crypto, import/export, passkeys, etc.
│   └── workers/                # Web Workers (Argon2id)
├── aegis-wxt/                  # Browser extension (WXT framework)
├── tests/                      # E2E tests (Playwright, 16 spec files)
├── guvenlik/                   # Security governance documentation
├── docs/                       # Technical documentation & CLI guides
├── scripts/                    # Build, release, CI tooling
└── relay/                      # Sync relay server

---

📄 License

This project is licensed under the MIT License. See LICENSE.

---

Built with security-first principles. Zero knowledge. No compromises.

_{Aegis Vault 5.0 — © 2026 hafgit99}