Launch HN: Infisical (YC W23) – Open-source secrets manager for developers
Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloakA few tips.1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible.2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down.3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain attacks on nodejs to worry about. You should only run the bare minimum JS on the frontend when dealing with encryption keys.4. You're storing keys in local storage. There's a trick you can do, if you store an actual CrypoKey object instead of a string and set non extractable to true you can stop JS extracting private keys.5. For key stretching looks like your using Argon2-browser. Actually browsers come with a built in with PBKDF2 that runs faster than a JS based argon. So I'm able to get 10 million iterations in a few seconds which is an NIST recommendation.6. Some of your dependencies look like they are not maintained anymore. i.e. argon2-browser.This is what I was able to find so far. Hope this helps.