Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
Hi. I'm also working on an E2E secrets manager. <a href="https://github.com/purton-tech/cloak">https://github.com/purton-tech/cloak</a><p>A few tips.<p>1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible.<p>2. Your CSP <a href="https://csp-evaluator.withgoogle.com/" rel="nofollow">https://csp-evaluator.withgoogle.com/</a> has unsafe-eval. I would lock that down.<p>3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain attacks on nodejs to worry about. You should only run the bare minimum JS on the frontend when dealing with encryption keys.<p>4. You're storing keys in local storage. There's a trick you can do, if you store an actual CrypoKey object instead of a string and set non extractable to true you can stop JS extracting private keys.<p>5. For key stretching looks like your using Argon2-browser. Actually browsers come with a built in with PBKDF2 that runs faster than a JS based argon. So I'm able to get 10 million iterations in a few seconds which is an NIST recommendation.<p>6. Some of your dependencies look like they are not maintained anymore. i.e. argon2-browser.<p>This is what I was able to find so far. Hope this helps.