Changelog

Decentralized, zero-knowledge password manager. All notable changes to this project are documented in this file.

Format: Keep a Changelog Versioning: Semantic Versioning

---

[1.8.10] — 2026-09-29

Android — 1.8.8 -> 1.8.10 (versionCode 42 -> 44, in build)

Added

• Native autofill service: VaultKeeperAutofillService fills login forms from any app (AssistStructure parsing, exact-domain matches sorted first, cap 30 datasets) behind a biometric gate — the credential cache is AES-GCM encrypted under a hardware Keystore key and only decrypts after the BiometricPrompt succeeds (AutofillUnlockActivity); cache exported on every vault save/unlock, wiped on vault reset. Wired via the withAndroidAutofill config plugin (service + translucent activity injected in the merged manifest)

Fixed

• Autofill Kotlin never compiled: AssistStructure.getWindowCount()/getWindowAt() do not exist (real API: windowNodeCount / getWindowNodeAt()), and setAuthentication() was given the PendingIntent instead of its IntentSender — the 2 EAS builds on 09/28 failed in compileReleaseKotlin with exactly these 6 errors. Fixed (ef2b40ea), build relaunched
• Autofill module sources were gitignored: apps/android/.gitignore line android/ swallowed the local expo module’s own android/ directory — EAS built from git compiled stale/missing Kotlin (78e9a7fb)
• allowBackup=false was silently dropped: withAllowBackup targeted <manifest> instead of <application>, so 1.8.9 shipped with OS backups allowed (MobSF finding on 1.8.8) — attribute moved to the right XML node (32b431f3, b6593c28)
• Splash referenced a nonexistent asset: splash-system-icon.png was not in git, EAS prebuild died ENOENT (10801931); .easignore now re-includes gitignored app assets for EAS (0b893b77); package-lock regenerated for the EAS npm 10 builder (d0ea48b6); EAS project relinked to account 0xjust1 after a corrupt projectId (4caa47a2)

Extension (Chrome + Firefox) — passkey engine repaired, form-anchored save-prompt & detection (1.8.8 -> 1.8.10)

Fixed

• “Save in VaultKeepR” / sign-in never reached the vault: the August security hardening (P0-SEC-04) classified PASSKEY_CREATE/GET/USE as sensitive and rejected every message from content scripts — but the WebAuthn bridge is a content script: the prompt showed, the page hung, then every site fell back to the native flow. The three bridge types are carved out (like autosave/TOS) behind the same sender-tab origin backstop; the handlers re-validate rpId against the sender origin; PASSKEY_DELETE stays popup-only; PASSKEY_USE gained the missing rpId↔origin check (27280b47)
• Passkey prompt buttons were click-dead and the prompt “hung”: the vanilla passkey overlays live inside the isolated shadow host (pointer-events: none for click passthrough) but never re-enabled pointer events — clicks fell through to the page and the bridge sat on its 30 s timeout before the native fallback. Both overlay roots now declare pointer-events: auto (a44f2cbe)
• Passkey entries were silently stripped at persistence: applyPendingOpsToEntries rebuilt entries with a login-only field whitelist, dropping type/rpId/credentialId/privateKeyHex — a created passkey could never be found again at sign-in. Pending-op replays preserve the full credential payload (27280b47)
• The save-prompt disappeared before you could click Save/Not: the auth-like POST hook (fetch/XHR interception deciding “the user just logged in”) patched window.fetch in the ISOLATED content world — invisible to the page; AJAX logins were never detected and the prompt only opened during beforeunload, dying with the page. The hook now lives in the MAIN-world page script (existing bridge) and the pending-save is written directly to chrome.storage.session (background opens the access level): the prompt opens at submit, stays clickable, and re-offers on the next page (9ad103c4)
• Keystrokes silently dropped on credential fields: the first login focus triggered heavy init that moved the focused input into a legacy wrapper — focus lost mid-typing (programmatic fill too). The wrapper now restores focus and the caret (9ad103c4)
• A red “2”-style counter next to fields: the legacy inline trigger rendered the site’s credentials count as a red number (numbers rejected) — hidden at every render path; toolbar badge and tooltip are clean (1abbcad1, dbdd4a08)
• Form-anchored intent detection: page-level signals (title/URL/headings) no longer outvote what the form itself says — current-password = always login, a strong signup submit verb outvotes a login call (Zoho), bare new-password on a /login page = the anti-password-manager trick (Proton), GitHub’s “Go to file” combobox is no longer a username field. Scale eval 89% on atomic labels, corpus 90.9%; suite 1928/1928 (9ad103c4)
• Android autofill + passkeys validated on device: preview APK dc2a83b8 (versionCode 44) tested on a real phone — native autofill and passkeys working

Store

• Play Store screenshots refreshed: shot 01 in a full phone frame (stitched header+list), brand-exact outline logo lockup, 2x supersampled mockup renders (8ac0fe1a, 00a0337c)

---

[1.8.8] — 2026-09-19

Extension (Chrome + Firefox) — 1.8.5 -> 1.8.8

Added

• Smart display names: entry lists show readable auto-generated names when no custom title is set (aligned with iOS + Android)
• TOTP badge on list rows: one-time codes rendered as a badge on the right of the row, before the chevron
• Vault CID in popup settings: the current vault CID is displayed with one-tap copy — users can cross-check the synced IPFS object against the web vault
• Post-import passkey notice: vaults received via pairing surface a re-enroll notice when passkey PRF coverage is missing
• TOS analyzer via same-origin fetch: public TOS/privacy pages are now fetched through the content script, with vaultkeepr.xyz added to the fetch allow-list
• Web vault origin passthrough: vault.vaultkeepr.xyz is treated as the web vault origin — native WebAuthn passes through instead of being intercepted

Fixed

• Pair send: the full vault payload is transmitted and the PRF blob fixed — a paired web vault receives a complete, decryptable state
• Enterprise auth payloads: use the account-abstraction address with lowercase contract casing
• Foreign received vaults: PRF-only coverage is no longer assumed for vaults received from other sources (unlock falls back correctly)

iOS — 1.8.7 -> 1.8.8 (build 16 -> 17)

• Maintenance rebuild for the App Store resubmission: same feature set as 1.8.7, version string in Settings reads 1.8.8

Web (vaultkeepr.xyz)

• Web vault routing: vault.* subdomain rewrites to /vault, “Open App” header link targets the vault origin
• Cross-device sync: decrypts sync payloads published with the V3 secret+signature scheme (extension delegation); current vault CID and sync-error detail surfaced in the settings panel
• Landing accessibility pass: WCAG AA contrast, accessible carousel with explicit pause and prefers-reduced-motion support, deterministic sticky sub-nav (IntersectionObserver), single accent color, hero reduced to four elements
• Shop page temporarily hidden (redirects, nav/footer links, sitemap)

Versioning

Platform	Version	Store
Chrome Extension	1.8.10	Chrome Web Store
Firefox Extension	1.8.10	Firefox Add-ons
iOS	1.8.10 (build 19, in build)	App Store
Android	1.8.10 (versionCode 44)	Play Store

---

[1.8.7] — 2026-09-10

Fixed

• Biometric prompt at vault creation, all paths (Android): the biometric probe (write + read with authenticationPrompt) was missing from the 2 remaining creation paths — handleImportBiometric (ImportMethodModal) and the existing-vault overwrite confirmation. Probe extracted to lib/biometricProbe.ts, running before any creation across all 3 paths: the fingerprint prompt now always shows and Keystore auth is established before biometric entries are written

Versioning

• Android: 1.8.6 -> 1.8.7 (versionCode 40 -> 41)

---

[1.8.6] — 2026-09-10

Fixed

• Biometric prompt at vault creation (Android): handleBiometricCreate never triggered a biometric authentication — writing to the Keychain with accessControl: BIOMETRY_CURRENT_SET does not prompt on Android (iOS behaves differently), and biometric entries written without prior authentication left the biometric unlock silently broken (getBiometricCombined failed with a swallowed exception, no prompt). Fix: biometric probe (write + read with authenticationPrompt, same pattern as SettingsAccessScreen) runs before any creation — the fingerprint prompt now shows at vault creation and biometric unlock works without toggling off/on

Versioning

• Android: 1.8.5 -> 1.8.6 (versionCode 38 -> 40)

---

[1.8.5] — 2026-09-09

Security (Android reviewer audit)

• android:allowBackup="false": OS backups (cloud + device transfer) can no longer copy app data — a zero-knowledge vault has no business in a backup we don’t control the encryption of
• Stripped unused permissions: RECORD_AUDIO (declared by expo-camera for video recording, never used), ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION removed from the merged manifest via tools:node="remove"; the withStrippedPermissions prebuild plugin extended accordingly. CAMERA kept (desktop/extension pairing QR code scan)
• exported components audit: MainActivity (launcher + vaultkeeper:// deeplink, required), ClipboardFileProvider (path-restricted + temporary grants), RevocationBoundService and ProfileInstallReceiver (protected by signature-level permissions) — no unjustified IPC surface
• HIBP k-anonymity documentation (apps/android/docs/SECURITY.md): the breach check sends only the first 5 characters of the SHA-1 hash (computed locally), the suffix is matched on-device and the response is padded (Add-Padding: true) — the password and its full hash never leave the device

Maintenance

• APK 189 MB → 101 MB: restricted to real device ABIs armeabi-v7a + arm64-v8a (reactNativeArchitectures in gradle.properties + defensive abiFilters in build.gradle) — x86/x86_64 libs were emulator-only (MLKit OCR, QuickCrypto, barhopper, Hermes duplicated across 4 ABIs)

iOS

• Rebuilt on Expo SDK 57 / React Native 0.86.3 / React 19.2.3 (branch chore/expo-57-upgrade): Hermes V1 memory regression resolved (present on SDK 56), New Architecture maintained, MLKit OCR + NFC compiled and validated with real native builds (gradle + xcodebuild)
• react-native-svg patched for RN 0.86 (patches/react-native-svg+15.15.4.patch): the ImageResponseObserverCoordinator observer API no longer accepts raw references — passing the shared_ptr directly; patch-package now wired into postinstall (the 6 existing patches were applied manually)
• Signed IPA: iPhone Distribution + auto-provisioned App Store profile com.vaultkeeper.app, autofill extension VaultKeeperCredentialProvider included — app-store-connect export ready for TestFlight

MobSF Security Audit (static + dynamic)

• MobSF 4.4.1 on final builds: IPA 51 → 73/100 (0 HIGH), APK 61 → 85/100 (0 HIGH) — official PDF reports (22 + 131 pages) and JSON shipped with the release artifacts
• iOS — full ATS: removed the entire NSAppTransportSecurity block (7 no-op exception domains + NSAllowsLocalNetworking) and NSLocalNetworkUsageDescription — sync traffic (HTTPS relay + public IPFS gateways) needs no exception, TrustKit pinning on VaultKeepR domains kept
• iOS — microphone permission removed (NSMicrophoneUsageDescription never used); camera (pairing QR scan + secure document capture) and photo library (cloud storage) usage strings now precisely documented
• iOS — WalletConnect residue purged (account abstraction migration): 3 stale exception domains (relay.walletconnect.org, walletconnect.org, gateway.ar.io), unused rainbow/trust/wc query schemes, dead prebuild plugin withYttriumWrapperPatch removed (no Yttrium pod in the Podfile.lock)
• iOS — debug symbols stripped: DEBUG_INFORMATION_FORMAT=dwarf-with-dsym (debug info moved to a .dSYM — crash symbolication available) + DEPLOYMENT_POSTPROCESSING/STRIP_INSTALLED_PRODUCT/STRIP_STYLE=all on both Xcode targets
• iOS/Android — bundle purged of scan.zkfair.io (MobSF hotspot, Hong Kong IP): custom Metro resolver mapping viem/chains → definitions/base.js — Metro does not tree-shake the barrel, so 50+ chain definitions (zkFair included) were shipped as dead strings in the bundle; only BASE chain strings remain
• Android — minSdk 24 → 29 (gradle.properties + expo-build-properties): removes the “installable on unpatched Android 7.0” HIGH; Android 8/9 (~3-4% of the install base) dropped, deliberate security trade-off
• Android — release signing verified: upload keystore, SHA-1 0F:1A:BF:09:40:6A... identical to the Play fingerprint; the 2 “debug certificate” HIGHs were signing artifacts of an unsigned build
• Android — WalletConnect residue purged: 4 wallet schemes (metamask/trust/rainbow/wc) removed from the <queries> block, withWalletQueries plugin deleted
• Dynamic analysis (rooted Android 11 emulator, MobSF MITM + frida):
  • TrustKit pinning proven effective: traffic to app.vaultkeepr.xyz + IPFS gateways cannot be intercepted (MobSF certificate rejected by the pin) — only non-pinned domains go through
  • HIBP k-anonymity verified in real traffic: api.pwnedpasswords.com/range/<5 characters> — the full hash never leaves the device
  • 0 trackers (0/432 known), 0 secrets at rest: shared_prefs and AsyncStorage contain no plaintext password/vaultKey/token/CID
  • 1 runtime bug caught and fixed: expo-clipboard asserts ClipboardFileProvider exported=true (startup crash) — the exported=false hardening attempt was reverted, library constraint documented (upstream report pending for expo-clipboard)
• Documented MobSF false positives (suppressed via API or justified in the report): iOS rpath (required for embedded OpenSSL/hermesvm frameworks), iOS “symbols not stripped” (MobSF matches radr://5614542, Apple’s stripped-binary marker — upstream bug), Android base-config system CAs (standard, pinning in place), 92 “hardcoded secrets” (Credential Manager i18n strings)

OpenSSF (public repo vaultkeepr-public)

• 3 OpenSSF badges earned on github.com/VaultKeepR/vaultkeepr-public:
  • Scorecard 7.8/10 (v5.1.1, 2026-09-09): CI/CD, supply-chain security (SLSA, pinned dependencies), protected branch, signed releases
  • Best Practices — Silver: bestpractices.dev/projects/14491 — governance, CONTRIBUTING/SECURITY/CODE_OF_CONDUCT/DISCLOSURE, reproducible release process (Passing level exceeded, Silver criteria met)
  • Baseline: minimum project security requirements verified
• Open-source governance already in place: GOVERNANCE.md, ROADMAP.md, minisign.pub (release verification)

HTTP Observatory (website vaultkeepr.xyz)

• Grade B+ (80/100), 11/12 tests passed (MDN Observatory, scan on 2026-09-09): HTTPS + HSTS preload + HTTP/www redirects + CSP (nonce + frame-ancestors ‘none’) + locked-down Permissions-Policy (camera/micro/geolocation empty) + 0 cookies
• Identified action: duplicated Strict-Transport-Security header (Next.js max-age=31536000; includeSubDomains + Cloudflare edge max-age=63072000) — deduplicate keeping the strongest policy (max-age=63072000; includeSubDomains; preload) to reach an A

Versioning

• Android: 1.8.2 -> 1.8.5 (versionCode 37 -> 38)
• iOS: 1.8.0 -> 1.8.5 (build 13 -> 14)

---

[1.8.3] — 2026-08-13

Security

• SLM engine migrated to on-device (packages/core/src/slm-engine.ts): Removed server proxy (/api/slm → shipdaily.xyz). Auto-tagging (categorizeEntries) now uses a deterministic domain/keyword classifier (FR+EN). Breach summary (summarizeBreach) uses the deterministic local fallback. No vault data (URL, username) leaves the device anymore — true zero-knowledge on iOS + Android
• Extension auto-tag on-device (slm-engine.ts + slm-background.ts + messaging.js): Wired the ASK_SLM_AUTOTAG handler (previously orphaned UI). Deterministic classifier, 0 network, aligned with mobile

SEO / Website

• Sitemap consolidation: robots.txt now points to /new-sitemap.xml (dynamic, complete) instead of the stale static /vk-sitemap.xml (deleted). Broken redirect /sitemap-main.xml removed
• Re-indexed /delete-account/* pages: Removed robots: index:false on all 4 pages (hub + [service], EN + FR) — the #1 impression source (329+/month) is no longer blocked
• hreflang in sitemap: buildSitemap.ts now emits <xhtml:link rel="alternate" hreflang> (en/fr/x-default) + missing FR pages added (/docs/fr, /security/fr, /privacy/fr, /terms/fr, /shop/fr)
• Semantic sections: /compare/keeper (Keeper vs BeyondTrust PAM), /migrate/vaultwarden (SQLite DB migration) — EN + FR
• Sourced SocialProof: “241 tests” stat → “496” (measured via vitest), fictional named testimonials replaced with verifiable open-source/zero-knowledge claims (E-E-A-T + legal risk eliminated)
• Keeper seoTitle: “2025” → “2026”

Maintenance

• Comment strip: 1271 files cleaned (babel AST for TS/JS/TSX, regex for Swift/Sol/Shell/YAML/MD/CSS). Type-safe (0 new errors), runtime-safe (496 core tests pass)
• Public open-source repo: Created github.com/VaultKeepR/vaultkeepr-public — 16 packages (enterprise excluded) + 3 Solidity contracts + bilingual EN/FR README + SECURITY.md. 0 comments, 0 internal artifacts, 0 leaks
• knip.json added (dead code analysis, calibrated for the monorepo)

Versioning

Platform	Version
Chrome/Firefox Extension	1.8.2
iOS	1.8.0
Android	1.8.1
Core SDK	(open-source)

---

[1.8.2] — 2026-08-09

Added

• Backup password (Chrome + Firefox): New recovery mechanism for PRF-only vaults (Touch ID / Face ID unlock without a master password). The user sets a backup password in Settings → Security, which encrypts the unlock secret (prfKey + secretKey) in an Argon2id + XChaCha20-Poly1305 envelope. On authenticator loss, the backup password decrypts the envelope → recovers the secret → unlocks the vault (local backup then IPFS).
  • Reminder banner in settings if PRF-only vault has no backup password configured
  • “Backup password” link in the unlock screen advanced options
  • Handlers: SET_BACKUP_PASSWORD, GET_BACKUP_PASSWORD_STATUS, REMOVE_BACKUP_PASSWORD, UNLOCK_WITH_BACKUP_PASSWORD (popup-only, marked SENSITIVE_MESSAGE_TYPES)
  • i18n: backupPassword.* keys (EN + FR)
• PRF cache seed after IPFS pull (vault-sync.js): pollCidAndSyncFromTab now seeds vaultKeeperPrfCachedEntries (local) after a successful pull if a passkey is enrolled → next Touch ID unlocks are fast (local cache <50ms) instead of re-pulling IPFS (~seconds)

Fixed

• Empty vault after rebuild / reload (unlock.js): The password unlock path (UNLOCK_FROM_IPFS) never seeded the local PRF cache. Since the backup is encrypted with the masterPassword (≠ prfKey), Touch ID could not decrypt it → vault permanently empty after rebuild. Fix: seedPrfCacheAfterRestore() called at all 4 restore points (local-backup fallback, local-backup newer, v3 IPFS decrypt, v1/v2 IPFS decrypt)
• Empty entry duplication on login forms (autosave-observer.ts): setupCardAndIdentitySubmitCapture used .some(detectIdentityField) which matched a single autocomplete="email" field (ubiquitous on Google/GitHub/SPAs) → silent ADD_IDENTITY created username="" password="" entries with no UI on every submit. Fix: now requires ≥3 identity fields AND excludes forms with a password field (mirrors hasIdentityForm)

Versioning

• Chrome Extension: 1.8.1 -> 1.8.2
• Firefox Extension: 1.8.1 -> 1.8.2

---

[1.8.0] — 2026-08-08

Added

• Light theme (iOS + Android): New runtime theming system (theme.ts + ThemeProvider) with an Appearance toggle in settings and system-level sync (userInterfaceStyle: automatic)
  • All iOS/Android screens and components converted to useThemedStyles (styles recomputed for the active theme)
  • Contrast fixes: generated passwords now readable in light mode, fixed dark cards made theme-aware (C.surface/C.border)
• Email breach scanner (iOS + Android): Ported email breach monitoring (consent + per-email status, vk_monitored_emails)
• Settings reorganization + Privacy section (iOS + Android + Chrome + Firefox): new Privacy section (sync frequency, clipboard auto-clear, TOS, persist session); Appearance toggle moved to General; Export moved to Storage & Sync
• Demo mode: removed the user-facing toggle (iOS) and the keyboard shortcut (extension) so demo screens can no longer be triggered

Fixed

• Mobile audit P0-P3 (41 findings): Full security fix pass across iOS/Android
  • Crypto: fixed CryptoKit AES-GCM decrypt, cipher||tag, manual CCCryptorGCM prototype
  • Native: userCanceled, @import CommonCrypto, extension localization (en/fr).lproj
  • iOS extension + main app build; Android prebuild OK (permissions stripped, OTA off)
• AutoFill: Fixed getBiometricRequirement crash (non-iterable destructuring) — callback now robust to scalar or array
• Cloud: Back button now shown in embedded mode (Cloud menu) and aligned with other screens (chevron + label)
• Theme: Fixed residual dark rendering on SyncScreen, DetailScreen, ShareScreen, ReceiveShareScreen, ExportSection (auxiliary style blocks converted to themed factories)

Versioning

• iOS: 1.7.0 -> 1.8.0 (build 7 -> 8)
• Android: 1.7.0 -> 1.8.0 (versionCode 33 -> 34)

---

[1.7.0] — 2026-07-14

Security

• Certificate Pinning: withCertPinning plugin activated on iOS and Android
  • Leaf pin + ISRG Root X1 (expiration 2027-06-01) in Info.plist
  • network_security_config.xml with real pins on Android
• Store Hardening (Sprint 1): Aligned extension host_permissions, removed test-overlays.html from web_accessible_resources, aligned 10 Android permissions (no RECORD_AUDIO), deleted 6 ghost folders
• Logger: New @vault-keeper/logger package (auto-redaction of CIDs V0/V1, addresses, tx hashes, base64 >200 chars, mnemonics). 884 console.* sites migrated to logger.{debug,warn,error,info} across 138 files
• FLAG_SECURE: useSecureScreen applied to 24 vault screens x 2 platforms (iOS + Android)
• Crypto docs: Updated all SECURITY.md / ARCHITECTURE.md / SYNC.md to XChaCha20-Poly1305 (vault) + Argon2id (t=3, m=64 MiB, p=4) + 6 UI badges

Added

• Mobile / Extension: In-app cloud file previews (CloudFilePreviewScreen), settings cleanup, cloud tab embedding and entry selector UI redesign
• Extension: SyncConflictBanner UI (P1-3) — visible surface when the remote vault is newer
• Blog: Blog API routes (POST/PATCH/DELETE) + n8n workflow for auto-publishing to website & X
• Dev.to: 4 cover images for dev.to articles (1Password vs VaultKeepR, Bitwarden vs VaultKeepR, Lastpass migration, zero-knowledge encryption)
• Web: /pricing and /fr/pricing pages with FAQPage + Product JSON-LD, inline MiniPricing on home, StickySubNav, dismissible TopBanner, ComparePreview (6 /compare cards), 3 long-tail articles (raspberry-pi, no-email, argon2id-vs-bcrypt), BACKLINK-PLAN.md, 38 new i18n keys EN + FR

Fixed

• Sync: Full cross-device P0-P2 audit (10 fixes, 0 regression)
  • P0-2: restoreIpfsMetadata moved from LWW entry-level to field-level 3-way merge (5 tests)
  • P0-4: Mobile pull/upload race condition resolved via shared in-process mutex (9 tests)
  • P1-1: CRDT entry-replace staleness fix (mergeDocuments, mergeIndependentDocs) — 6 tests
  • P1-3: SyncConflict descriptor surface + 2 IPC messages + 5 i18n keys FR/EN (5 storage tests)
  • P1-4: Merge base snapshot pre-push in IpfsAutosave (local edit loss cross-device)
  • P1-5: getDeviceId() returns a stable UUID v4 per install (instead of buggy “ios-ios”) — 12 tests
  • P2-1: Cross-device E2E test (crossDevice.e2e.test.ts) — 9 scenarios (found 2 real bugs)
  • P2-2: purgeTombstones() now called after merge
• SEO: Fixed GSC issues — 301 redirects on /landing and /passkey-auth, noindex on /settings, /turbo-*, /premium/checkout, og/twitter images and _next/static, bug bounty removed from sitemap, real blog dates in sitemap
• Extension: escapeHtml now escapes " and '; includesIgnoreAccents via stripDiacritics; simulateUserFill removed element.click(), dispatches beforeinput first, respects defaultPrevented; V1 phishing overlay backward-compat; classifyFormSignals by typed intent (7 call sites); handleFill scoped to nearest form
• Extension: Fixed Rules of Hooks in overlays-v2/generate (useCallback/useMemo before early return) + missing i18n keys generator.copy and generator.strength.*
• n8n: Regenerated workflow JSON with proper escaping (valid JSON)
• Dev.to: Redesigned cover images

Improvements

• Web: SEO overhaul — HeroSection with visible keyword H1, trust signals, secondary CTA, anchor IDs (#features, #how-it-works, #security, #faq), moved 31 obsolete .md files to archive/
• Tests: Comprehensive security test suite — 1015 tests across all packages; 1529/1529 passing (105 files, 0 failures) after 30 test fixes

Versioning

• Chrome/Firefox extension: 1.7.0 (already aligned)
• iOS: 1.6.5 -> 1.7.0 (build 6 -> 7)
• Android: 1.6.5 -> 1.7.0 (versionCode 31 -> 33)

---

[1.6.5] — 2026-06-02

Added

• Legacy: Cross-device, end-to-end encrypted synchronization of beneficiary metadata via IPFS
  • Robust cryptographic mechanism using HKDF and local key derivation to guarantee zero-knowledge privacy
  • Server route /api/legacy/beneficiaries-cid to decentralize the storage of the IPFS content identifier (CID)
• Android: Full native implementation of AutofillService (VaultAutofillService.kt) for secure, system-wide credential autofill

Fixed

• iOS: Fixed UI refresh and state navigation after manual or automatic Legacy activation
• Extension: Enhanced domain matching precision for TOTP and credentials autofill queries
• Mobile / Extension: Fixed visibility and rendering issues of beneficiary labels on secondary devices

---

[1.6.4] — 2026-05-29

Added

• Legacy: New encrypted vault inheritance system for designated beneficiaries
  • Smart Contract: VaultKeeperLegacy.sol (Base Mainnet — Chain ID 8453)
    • On-chain heartbeat with configurable cooldown
    • Multi-beneficiary management with percentage-based shares (must total 100%)
    • Activation by owner or automatic heartbeat expiry
    • Encrypted fragment claiming via ECDSA signature (EIP-712 envelope)
    • Events emitted: HeartbeatUpdated, VaultActivated, FragmentClaimed
    • Foundry deployment script (DeployLegacy.s.sol) — deployed on Base Mainnet
  • Package @vault-keeper/legacy: Full TypeScript SDK
    • heartbeat.ts: On-chain heartbeat update + automated scheduling (1x/week)
    • beneficiary.ts: Add/remove/list beneficiaries with share validation
    • envelope.ts: ECIES encryption of vault fragments per beneficiary
    • contract.ts: ABI and helpers for interacting with VaultKeeperLegacy
    • legacy.ts: High-level orchestrator (activation, claim, status)
    • Test suite: 3 unit test files (heartbeat, beneficiary, envelope)
  • Web: 8 new API routes /api/legacy/*
    • activate: Manual legacy activation (owner only)
    • check-expiry: Heartbeat expiry verification
    • claim: Fragment claim by a beneficiary (with ECDSA signature)
    • claim-invite: Beneficiary invitation link validation
    • encode-call: Calldata encoding for on-chain transactions
    • invite: Invitation link generation and delivery to beneficiaries
    • notify: Telegram + email notification to beneficiaries
    • status: Full legacy vault status (heartbeat, beneficiaries, activation state)
  • Web: Beneficiary invitation page (/legacy/invite)
    • Dedicated layout with invitation token validation
    • Claim interface with wallet connection and signature flow
  • iOS / Android: New LegacyScreen
    • Legacy configuration dashboard (heartbeat, beneficiary list, status)
    • Add/remove beneficiaries with share allocation
    • Visual heartbeat status indicator (active / expired / not configured)
    • Integrated navigation from RootNavigator and SettingsScreen
  • Extension: New LegacyPanel
    • Accessible from extension settings (SettingsView)
    • Legacy configuration and heartbeat status visualization
• Telegram Bot: Legacy notification bot (telegramBot.ts)
  • Sends structured messages to beneficiaries upon vault activation
  • Claim instructions with direct link to /legacy/invite
  • Full setup documentation (docs/TELEGRAM_BOT_SETUP.md)
• Legacy Emails: Email templates for beneficiary notifications (legacyEmails.ts)
  • Initial invitation email with claim instructions
  • Activation email with secure link and deadline

Fixed

• Crypto Payments: Refactored /api/premium/crypto/order and /api/premium/crypto/status routes
  • Separated order/status responsibilities
  • Improved error handling for on-chain polling
• Alias: Updated packages/alias/src/config.ts configuration
• Smart Account: Updated packages/smart-account/src/config.ts configuration

Types & i18n

• Core: Extended packages/core/src/types.ts with Legacy types (LegacyConfig, Beneficiary, LegacyStatus)
• i18n: Added Legacy translation keys in packages/i18n/src/translations.ts (FR + EN)

Infrastructure

• Vercel: Added apps/web/vercel.json for rewrite rules and security headers configuration
• Broadcast: Foundry deployment artifacts on Base Mainnet (contracts/broadcast/DeployLegacy.s.sol/8453/)
• Tests: VaultKeeperLegacy.t.sol test suite for the smart contract

Versioning

• legacy branch created from release/1.6.4
• VaultKeeperLegacy smart contract deployed on Base Mainnet (Chain ID 8453)

---

[1.6.3] — 2026-05-24

Security

• HPKP: Added Public-Key-Pins header (report-only) on app.vaultkeepr.xyz with SHA-256 pin of the Let’s Encrypt certificate
• Bundler Relay: Secure proxy /api/relay/bundler for ERC-4337 calls (Pimlico) — API key is no longer exposed client-side

Fixed

• Extension: Fixed false positive login form detection (login-detect.ts)
  • Added 17+ ignore patterns (contact, newsletter, support, chat, feedback, subscribe, etc.)
  • hasLoginForm() now requires 2+ signals (autocomplete, pattern, label) instead of 1
  • Standalone email fields in non-login forms no longer trigger the overlay
• Extension: Username is now captured at form submit time (snapshot _pendingSaveData)
  • Fixes the bug where only the password was saved during credential capture
  • Save prompt uses snapshotted credentials instead of re-collecting DOM fields (prevents empty values after SPA navigation)
• Extension: Added automatic save prompt after password generation via the extension button
  • 2-second post-generation timer to allow username field completion
  • Automatic add/update detection based on existing entries
• Extension: Fixed “Premium required to create email aliases” bug (usePremium.ts)
  • Added cross-address discovery (findAnyStoredLicenseKey) when address changes (EOA → Smart Account migration)
  • Automatic license migration to the new address
• Extension: Generated passwords are now accessible in the generator history
  • getGeneratedHistory() now returns passwords (previously stripped for security but prevented reveal + copy)

Improved

• Extension / iOS / Android: Added reveal/hide toggle (Eye/EyeOff) in password history
  • Generator: each generated password is masked by default with individual toggle
  • Credential detail: old password history now has a per-item reveal toggle
  • Consistent behavior across all 3 platforms
• Notes: Fixed note font color in credentials (white color consistency)

Versioning

• Chrome/Firefox Extension: 1.6.2 → 1.6.3
• iOS: 1.6.1 → 1.6.3 (build 4)
• Android: 1.6.1 → 1.6.3 (versionCode 26)

---

[1.6.2] — 2026-05-22

Fixed

• QRSync: Fixed vault transfer from iOS to the extension — the received vault is now correctly imported into extension storage (the CustomEvent had no listener)
• QRSync: Fixed AA (Account Abstraction) address mismatch after vault reception — secretKey is now stored before the cached password to prevent a race condition during identity derivation
• QRSync: Settings panel now auto-closes after a successful import
• QRSync: Automatic Premium license transfer during device pairing

Improved

• IPFS Sync: Polling interval reduced from 30s/60s to 10 seconds across all platforms (iOS + Extension)
• Extension: Popup polls IPFS every 10s while open (chrome.alarms limited to 30s in background)
• Extension: Background alarms reduced from 5min/1min to 30s/30s

Versioning

• Chrome/Firefox Extension: 1.6.1 -> 1.6.2
• iOS: polling interval changed (no version bump)

---

[1.6.1] — 2026-05-19

Security

• P0 Audit — In-App Purchase: Complete IAP validation pipeline hardening
  • (P0-#1) Server-side Android IAP validation via Google Play Developer API (purchases.subscriptionsv2.get, JWT RS256)
  • (P0-#2) Cryptographic verification of Apple StoreKit 2 JWS signatures
    • Pinned Apple Root CA - G3 certificate (SHA-256 fingerprint verified)
    • x5c chain validation (DER), ES256 IEEE-P1363 signature verification
    • 8 rejection test cases (alg=none, alg=HS256, missing x5c, invalid DER)
  • (P0-#3) Strict productId whitelist (productIdMap.ts) — removed all String.includes() tier inference
    • Apple: com.vaultkeeper.app.<tier>.<billing>
    • Android: (productId, basePlanId) tuple — 10 test cases
  • (P0-#4) Rejected legacy 0xpasskey signatures (public rawId bypass)
    • Synthetic address derived from rawId is no longer accepted server-side
    • 5 tests covering the historical forgery vector
• Passkey ECDSA: Real cryptographic infrastructure for wallet-less users
  • Phase 2: secp256k1 derivation via WebAuthn PRF extension + HKDF-SHA256
  • Phase 3: Stealth signer wired into VaultView (4 callsites replaced)
  • TOFU (Trust-On-First-Use) binding with anti-squat protection via expectedCid
  • Zero npm dependencies added — uses @noble/hashes, @noble/curves, viem
• WalletConnect: Complete removal of WalletConnect protocol from the extension
  • walletConnect.js replaced with a deprecated no-op stub (482 -> 72 lines)
  • Removed WalletConnect WSS endpoints from CSP and manifest
  • Identity is now managed exclusively through Account Abstraction (Smart Wallet)

Fixed

• Sync: Hardened 3-way merge (threeWayMerge) — 4 data-loss bugs fixed
  • B1: Cross-device folder deletion propagation via folderTombstones (30-day TTL)
  • B2: cloudQuotaUsed recomputed from merged files (no more upward drift)
  • B3: Field-level merge for documents and cloudFiles (no more whole-item LWW)
  • B4: Deterministic tie-breaker for simultaneous conflicts
  • 16 regression tests
• Resilience: Preserved local state on transient server errors (5xx / network)
  • cidPointer.ts: Discriminated result type (auth vs network vs corrupted) — no more premature delegation clearing
  • PremiumContext: Premium cache preserved on 5xx/network errors (iOS, Android, Web)
• Mobile: Fixed AA address drift after biometric re-authentication
  • Replaced getOrCreateSecretKey() with getStoredSecretKey() during biometric unlock (iOS + Android)
  • Forced identity initialization even with empty password (Passkey flow)
• Extension: Auto-sign with Hidden Wallet as fallback when no delegation is available
• Extension: Simplified CSP (connect-src 'self' https:) — removed WalletConnect whitelist
• iOS: Fixed Restore Purchase on StoreKit 2 (getAvailablePurchases instead of broken restorePurchases in expo-iap v3)

Added

• Mobile: Tag filter in credentials list (iOS + Android)
  • Horizontal scrollable bar with dynamic colored chips
  • Tap selection/deselection with haptic feedback

Versioning

• Chrome/Firefox Extension: 1.6.0 -> 1.6.1
• iOS: 1.6.0 -> 1.6.1 (build 1)
• Android: 1.6.0 -> 1.6.1 (versionCode 19)

---

[1.6.0] — 2026-05-17

Security

• Sharing v2 (SEC-R4): Removed the ECDH self-loop in the secure sharing protocol
  • Direct HKDF(ephemeralPrivKey, SHA256(PIN)) derivation instead of redundant ECDH(priv, priv*G)
  • URL fragment now carries the private key (32 bytes) instead of the public key (65 bytes) — shorter URLs
  • Compact v2 blob (no encrypted private key in the blob, -72 bytes)
  • v1 backward compatibility maintained for existing shares
  • 8 callers updated across iOS, Android, Extension, and Web
• Extension CSP (SEC-R7): Hardened Content Security Policy with 9 explicit directives
  • default-src 'self' — everything blocked by default
  • connect-src restricted to 5 whitelisted domains + 2 WalletConnect WSS endpoints
  • frame-src 'none', object-src 'none', base-uri 'self'
  • wasm-unsafe-eval preserved (required by Argon2 + Automerge CRDT)
  • Audit confirmed: zero eval() / new Function() in the codebase

Fixed

• Core: Fixed openpgp/lightweight -> openpgp in import.ts
  • The ./lightweight subpath lacks a Node-compatible import condition — was blocking tests
  • Resolved 2 pre-existing test failures in the core test suite
  • Unblocked @vault-keeper/recovery package (tests were unrunnable before)
• P2 Parity: Formalized 6 features already implemented but undocumented
  • Android Credential Provider (VaultAutofillService.kt)
  • Google Play Billing (PremiumContext.tsx + expo-iap)
  • Email Aliases iOS/Android (AliasPanel.tsx + useAlias.ts)
  • Password History (3 platforms)
  • Passphrase Generator (3 platforms)
  • Seed Phrase Manager (Extension EditForm + DetailPane + iOS/Android folders)

Tests

• 241 tests, 0 failures (up from 163 tests with 2 failures in 1.5.x)
  • @vault-keeper/core: 95 -> 173 tests (+78)
  • @vault-keeper/premium: 6 -> 31 tests (+25)
  • @vault-keeper/recovery: 0 -> 8 tests (unblocked)
  • New test files: sharing.test.ts, passwordHealth.test.ts, passwordStrength.test.ts

Versioning

• Unified cross-platform version to 1.6.0
  • Chrome/Firefox Extension: 1.5.0 -> 1.6.0
  • iOS: 1.5.1 -> 1.6.0 (build 8)
  • Android: 1.5.2 -> 1.6.0 (versionCode 19)

---

[1.5.2] — 2026-05-05

Fixed

• iOS: Resolved Apple App Store rejection (Guideline 3.1.2(c)) — added Terms of Use and Privacy Policy links in the in-app purchase flow
• iOS: Removed visible license key input field (Guideline 3.1.1) — cross-platform premium now resolves silently via wallet address
• iOS: Added legal footer below purchase button with auto-renewal disclosure
• iOS: Optimized PremiumScreen layout to ensure legal footer visibility for reviewers
• Android: Build AAB 1.5.2 (versionCode 10) for Play Store
• i18n: Replaced all remaining hardcoded French strings with proper translation keys

---

[1.5.1] — 2026-05-04

Fixed

• Web: Achieved functional parity between Webapp and iOS — integrated sync management
• Web: Added Delegation Status Card and Wallet Connection display in Settings Sync tab
• Web: Finalized delegation renewal flow (message signing + persistent storage)
• Web: Removed legacy CRDT synchronization dead code causing JSON compatibility errors
• iOS: Restored IPFS synchronization and recovery flow
• i18n: Fixed missing translation keys for sync status indicators

---

[1.5.0] — 2026-05-03

Added

• Premium: New 4-tier subscription model (Free / Premium / Pro / Ultimate)
  • Free: 1 document, 5 MB max file size, no cloud storage
  • Premium: 2 documents, 25 MB max, 10 MB cloud
  • Pro: 5 documents, 25 MB max, 50 GB cloud
  • Ultimate: unlimited documents, 50 MB max, unlimited storage
• Cloud: Encrypted multi-node cloud storage with end-to-end encryption
• Crypto Payments: Anonymous multi-chain checkout (BTC, ETH, SOL, USDC) for the Lifetime plan at EUR 299
  • Multi-chain HD Wallet with real-time on-chain polling
  • CoinGecko live exchange rates
  • Flexible timer (2h for BTC, 30min for others)
  • Automated license key delivery — zero email required
• Landing Page: Overhaul with new feature cards (Cloud Storage, Quick Share, TOS AI, Password Health), Premium crown badges (Lucide), Android/Play Store link
• Privacy Policy: Updated to reflect new cross-platform data handling practices
• Android: First AAB build 1.5.0 for Google Play Store (internal test track)
• Extension: Published v1.5.0 on Chrome Web Store and Firefox Add-ons

Fixed

• Extension: Resolved production build dependency issues
• iOS: Synchronized Xcode versions (1.5.0, build 8)
• Legal: Updated Terms of Service with Lifetime plan, Fair Use policy, and non-refundable crypto disclaimers

---

[1.4.0] — 2026-04-29

Added

• Extension: Redesigned anti-phishing banners — more visible and informative
• Extension / iOS: Interactive onboarding tour with spotlight guide for new users
• Extension: Improved email alias management panel
• NFC: Full PACE protocol implementation on iOS — encrypted password read/write on NFC tags
• Passkeys: Cross-platform WebAuthn/FIDO2 support (Extension + iOS)
• IPFS Sync: Improved cross-platform synchronization with emoji cleanup in translations
• CRDT Sync: New @vault-keeper/sync package based on Automerge
  • Phase 2: Integrated CRDT merge across all platforms
  • Phase 3: Dual-format IPFS payloads (JSON + CRDT)
  • Phase 5: Cleanup and tombstone management
• CI: Automated workflow to sync public packages to the open-core repository
• Recovery: Fixed type mismatch for decryptVault return type in fragmented vault creation

Fixed

• Mobile: Resolved spotlight tour coordinate misalignment on Android
• Tests: Updated vault migration tests to reflect new notes and seeds categorization logic

---

[1.3.0] — 2026-04-21

Added

• Secure Share: Complete redesign of the secure sharing module
  • New secret.vaultkeepr.xyz subdomain for shared links
  • Optional personal message with each share
  • Full i18n (FR + EN) for all module strings
• Quick Share: New standalone module across all platforms (Web, Extension, iOS, Android)
  • Share links, notes, and files (Premium only)
  • Upload up to 50 MB with custom message
  • Accessible via shortcut button in the extension toolbar
• Extension: Full popup navigation and UI redesign
  • Reorganized settings menu into 5 logical categories
  • Fixed password generator display

Fixed

• Extension: CSP bleeding overlay fix (display: none inline)
• Extension: WalletConnect attestation 400 fix (corrected metadata.url)
• Extension: Added public key to manifest to stabilize extension ID across dev browsers
• Extension: declarativeNetRequest to spoof Origin on WalletConnect WebSockets (bypass 403)
• i18n: Removed duplicate title key in generator translations

---

[1.2.0] — 2026-04-20

Added

• NFC PACE: Identity document NFC authentication via the PACE protocol (iOS)
• Secure Documents: Encrypted document vault (Premium)
  • Upload and encrypt sensitive documents (ID cards, passports, driver’s licenses, bank details, insurance)
  • Fragmented across multiple IPFS nodes using XChaCha20-Poly1305
  • Blurred thumbnail preview with timed reveal (15-second auto-hide)
  • OCR text extraction with NFC-based biometric verification
• Android: First release of the Android mobile application (React Native + Expo 55)
• Extension: Multiple stability fixes

---

[1.1.0] — 2026-04-05

Added

• Premium: Complete visual overhaul (Glassmorphism, animations, global UI refresh)
  • New Premium subscription modal
  • Security tools integration into the Premium interface
• Web: Premium visual overhaul with modal, Password Health and Breach Scanner integration

Fixed

• iOS/Web: Fixed IPFS sync authentication, removed double Face ID prompt, improved ListScreen performance
• CSP: Added nonce to JSON-LD scripts in layout and blog pages

---

[1.0.0] — 2026-03-30

First stable release tag.

Added

• Core: XChaCha20-Poly1305 + Argon2id cryptographic engine (64 MiB, 3 iterations, 4 parallelism)
  • HMAC-SHA256 commitment scheme (prevents ciphertext substitution)
  • Gzip compression before encryption
  • Vault versions 2 and 3 support
• Recovery: Shamir Secret Sharing (3-of-5) with HKDF-encrypted fragments
  • Distribution: Device, IPFS, Trusted Contact, Smart Contract, VaultKeepR API
• Premium: HMAC-SHA256 server-signed license key system
  • Stripe (Web), In-App Purchase (iOS), license key activation (Extension)
  • Premium branded email templates (dark theme, logo, bilingual)
• IPFS: Upload/download with multi-gateway fallback (Promise.any())
• Passkeys: Full WebAuthn/FIDO2 support (ES256, P-256 ECDSA)
• TOTP: Built-in authenticator (SHA-1, SHA-256, SHA-512) with animated countdown
• Password Health: Dashboard with zxcvbn scoring, reuse detection
• Breach Monitoring: HIBP integration with k-anonymity
• Email Aliases: Privacy-focused email alias generation and management (Premium)
• Password Generator: Cryptographically secure generation with rejection sampling (eliminates modulo bias)
• Smart Contract: VaultKeeperFragments.sol — on-chain encrypted fragment storage (EVM)
• Bug Bounty: Bug Bounty Vault Challenge with dedicated page, scripts, and API
• Web App: Next.js 15 (App Router)
  • Landing page with particle animations and glassmorphism
  • Full vault CRUD (passwords, cards, identities, documents)
  • SEO blog (12 articles)
  • Bilingual legal pages (Privacy Policy, Terms of Service, Security Policy)
  • Sitemap, robots.txt, OpenGraph, JSON-LD
• iOS App: React Native 0.83.2 + Expo 55
  • Face ID / Touch ID biometric unlock
  • NFC document scanning
  • Credential Provider Extension (iOS AutoFill)
  • WalletConnect v2 deep linking
  • 23 screens
• Chrome Extension: Manifest V3
  • Smart login form detection with autofill overlay
  • Registration form detection with password generator
  • Identity and credit card autofill
  • Autosave observer (detects successful form submissions)
  • dApp phishing detection (MetaMask, ChainPatrol, Scam Sniffer registries)
  • Keyboard shortcuts (Cmd+Shift+L, Cmd+Shift+G)
  • Command palette (Cmd+K)
  • 39 React components in popup
• Firefox Extension: Chrome codebase port with adapted manifest
• i18n: Full French + English translations (@vault-keeper/i18n)
• CI/CD: GitHub Actions pipeline (lint, type-check, build, test, E2E Playwright)
• Tests: 241+ unit and integration tests across 7 packages
• Legal: ANSSI declaration, BIS Export Control, Chrome Web Store and Firefox Add-ons compliance
• Security:
  • Comprehensive pre-bug bounty audit (C1, C2, H1-H4, M3, M5, L1)
  • Removed PBKDF2 (v1) — Argon2id only
  • Removed unsafe-eval from CSP
  • Auto-backup of stores
  • Full API hardening (auth + rate limiting on all routes)
  • Umami API monitoring via middleware
  • Server hardening (SSH key-only, UFW, Fail2Ban, systemd sandboxing)

---

[0.x] — 2026-03-03 to 2026-03-29 (Pre-release)

Initial Infrastructure

• 2026-03-03: Initial commit + Expo 55 dependency sync for iOS
• 2026-03-21: Full monorepo import with Turborepo structure
  • GitHub Actions CI configuration (Node 22)
  • Resolved workspace lockfile issues
  • Build pipeline: core > i18n > ipfs > wallet > premium > alias > cloud > web > extension

Pre-1.0 Development

• 2026-03-24: Fragments UI, “Coming Soon” landing, Premium system, Solidity contracts
• 2026-03-26: UI/UX modernization + VaultView.tsx refactoring (3670 to 2677 lines, -27%)
  • Extracted UI components
  • 40 unit tests for extracted modules
  • First-run onboarding overlay for extension
• 2026-03-27: Added framer-motion for extension popup animations
• 2026-03-28: Custom IPFS gateway, WalletConnect fix, modular content script architecture
• 2026-03-29: iOS UX modernization — visual alignment with extension

Pre-launch Security Hardening (2026-03-31 to 2026-04-02)

• Legal, security, monitoring, and backup audit
• Privacy policy rewrite
• API hardening (auth + rate limiting)
• Real-time TOTP overlay with Fill + Copy buttons
• Overlay performance: reduced latency (30ms debounce, 5s TTL cache, 150ms animations)
• QR code WalletConnect for IPFS save signature
• Complete vault isolation (purge WC SDK keys)

---

Current Platform Versions

Platform	Version	Distribution
Web App	1.6.5	vaultkeepr.xyz
Chrome Extension	1.8.0	Chrome Web Store
Firefox Extension	1.8.0	Firefox Add-ons
iOS	1.8.0 (build 8)	App Store
Android	1.8.0 (versionCode 34)	Google Play
Smart Contract (Legacy)	Base Mainnet	basescan.org

---

VaultKeepR — Decentralized. Private. Yours.