fix(security): remove insecure legacy crypto and fix Turnstile in Docker#43
Merged
pankaj-bind merged 2 commits intomainfrom Apr 4, 2026
Merged
fix(security): remove insecure legacy crypto and fix Turnstile in Docker#43pankaj-bind merged 2 commits intomainfrom
pankaj-bind merged 2 commits intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…, and fix Turnstile in Docker - Delete hashPasswordForAuth from encryption.ts: naive SHA-256(password||salt) with no key stretching that undermined Argon2id protection - Remove _plaintext bypass from decryptCredentialFields: allowed a compromised server to inject plaintext and skip client-side decryption entirely - Remove _plaintext fields from backend duress fake vault data in services.py - Remove associated hashPasswordForAuth tests from encryption.test.ts - Fix Cloudflare Turnstile not rendering in Docker builds: .dockerignore excluded .env files so REACT_APP_TURNSTILE_SITE_KEY was empty at build time. Added ARG/ENV directives to Dockerfile.local and Dockerfile, and build args to docker-compose Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The project uses Argon2id (memory-hard KDF) via cryptoService.ts for key derivation, but all documentation and user-facing pages incorrectly stated PBKDF2. Updated: - README.md: sequence diagram, features, tech stack table - SECURITY.md: key derivation diagram - docs/API.md: auth_hash field descriptions - frontend/public/docs/: README, SECURITY, API (served to users) - HomePage.tsx, LandingPage.tsx: hero section encryption description Note: encryption.ts still correctly references PBKDF2 since that file genuinely uses PBKDF2 for legacy per-field encryption via Web Crypto API.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hashPasswordForAuthfromencryption.ts— a dangerous legacy function using naiveSHA-256(password||salt)with zero key stretching, completely undermining the Argon2id protection. No production code was calling it (dead code), but it was exported and available as an attack surface._plaintextbypass fromdecryptCredentialFields— this allowed data tagged with_plaintextto skip client-side decryption entirely. A compromised server could inject_plaintextinto any API response to bypass the zero-knowledge encryption model._plaintextfields from backend duress fake vault data inservices.py. Duress mode continues to work via the zero-knowledge vault path (ZeroKnowledgeVaultServicewithdecoy_vault_blob+duress_salt)..dockerignoreexcluded.envfiles, soREACT_APP_TURNSTILE_SITE_KEYwas empty atnpm run buildtime inside Docker. AddedARG/ENVdirectives to bothDockerfile.localandDockerfile, andargstodocker-compose.local.yml.Files Changed
frontend/src/utils/encryption.tshashPasswordForAuth, removed_plaintexttype and bypassfrontend/src/utils/__tests__/encryption.test.tshashPasswordForAuthimport and 4 testsbackend/api/features/vault/services.py_plaintextblocks from fake vault datafrontend/Dockerfile.localARG/ENVfor React build-time env varsfrontend/DockerfileARG/ENVfor React build-time env varsdocker-compose.local.ymlargsto pass Turnstile key and API URLTest plan
http://localhosthashPasswordForAuth