Work / AtlasVault
Case study 03
AtlasVault
An encrypted vault for secrets that never leaves the machine it runs on.
The problem
A cloud password manager asks you to trust a server you cannot inspect with the one set of credentials that opens everything else you own.
The system
A Tauri desktop shell with a Rust backend and a React and TypeScript frontend. Secrets are encrypted with AES-256-GCM authenticated encryption, the key derived from the password with Argon2id, nonces generated securely per record. Storage is local SQLite. There is no network dependency at all, so there is no server to breach.
- Encryption
- AES-256-GCM, authenticated, 256-bit key
- Key derivation
- Argon2id
- Storage
- SQLite, local only
- Shell
- Tauri, Rust backend, React and TypeScript frontend
- Interfaces
- Desktop app and CLI
The result
The documentation states plainly what the tool does not protect against: physical access to an unlocked device, malware and keyloggers, and OS-level attacks. It recommends full-disk encryption underneath as a second layer. Threat modelling stated out loud rather than a security claim with nothing behind it.
Let's build something useful.
Send the problem, not a spec. I reply with an approach and a scope I can hold to.