Keep server data in an encrypted database, and harden every part

Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).

Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
  browser that started it, bound by a cookie and PKCE; identities are never
  linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
  checked outside the store lock with uniform timing, one-time codes work
  once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
  pushes before storing them, and run at most two merges at once. A version
  is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
  frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
  without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
  retired file names apart, never overwrite a save made during a pull,
  require https except locally, send the stream token in a header, bound
  their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
  modern TLS and HSTS, and CI deploys from main only.

Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/deb/client/changelog

@@ -1,3 +1,16 @@
+keeporg (0.6.0) unstable; urgency=medium
+
+  * Security hardening: the tray and CLI open only the server's own 
+    approval page at sign-in; database names that differ in case, or match 
+    a file left by a database you lost access to, no longer share a file; 
+    renames never replace a file; a save made during a pull is never 
+    overwritten; https is required except for this machine 
+    (allow_insecure_http); the event stream sends its token in a header; 
+    bounded reads from the server; escaped notifications; control 
+    characters stripped from terminal output; escaped autostart entries.
+
+ -- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com>  Mon, 02 Nov 2026 15:26:52 +0100
+
 keeporg (0.5.0) unstable; urgency=medium
 
   * KeepOrg is now a system tray application: started without a command (or 

packaging/deb/server/changelog

@@ -1,3 +1,36 @@
+keeporgd (0.12.0) unstable; urgency=medium
+
+  * Security hardening after an audit. Single sign-on: a device is approved 
+    only by an explicit Approve in the browser that started the sign-in; 
+    the round trip is bound to that browser by a cookie and uses PKCE; 
+    identities are never linked to accounts by username, by verified email 
+    only when link_verified_email is set, never to administrators; existing 
+    accounts link from their Account page. Sign-in: per-address and 
+    per-account attempt limits (429), password hashing outside the store 
+    lock, uniform timing, one-time codes good once, starting two-factor 
+    needs the password. Merge vaults: bounds on KDF parameters, payload 
+    size and XML shape; pushes checked before storing; at most two merges 
+    at once. A version is written in the same transaction as its metadata. 
+    Tokens in URLs only on the event stream; streams end on revocation. 
+    CSP, frame-ancestors, no-store and HSTS on every response; sign-in form 
+    CSRF. 404 for databases without access. New trusted_proxies / 
+    KEEPORG_TRUSTED_PROXIES.
+
+ -- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com>  Mon, 02 Nov 2026 15:26:52 +0100
+
+keeporgd (0.11.0) unstable; urgency=medium
+
+  * The server keeps its data in SQLite (the default, a file in the data 
+    directory) or PostgreSQL (database setting, KEEPORG_DATABASE_URL or 
+    -database), every row encrypted with AES-256-GCM under a key derived 
+    from the master key and named by an HMAC, the KDBX versions included. 
+    The master key is now required to start, and a different key is 
+    refused. A data directory from 0.10 or earlier is imported on first 
+    start and its old files set aside. Several servers may share one 
+    PostgreSQL database. -reset-admin no longer needs the server stopped.
+
+ -- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com>  Mon, 02 Nov 2026 13:59:24 +0100
+
 keeporgd (0.10.0) unstable; urgency=medium
 
   * New Account page in the web interface: every signed-in browser and 

packaging/docker/compose.yaml

@@ -8,8 +8,12 @@
 #
 # The key is provisioned as a secret and named to the server with
 # KEEPORG_MASTER_KEY_FILE, so it is never in the process environment and
-# never on a disk the container can write. Without a key the server still
-# runs and still synchronizes; it only refuses to create or merge vaults.
+# never on a disk the container can write. Everything the server stores is
+# encrypted under that key, so it does not start without it.
+#
+# The data goes to a SQLite file on the keeporg-data volume. For PostgreSQL,
+# set KEEPORG_DATABASE_URL below instead; the volume then only matters for
+# importing a data directory from 0.10 or earlier.
 
 services:
   keeporgd:
@@ -36,6 +40,9 @@ services:
       - keeporg_master_key
     environment:
       KEEPORG_MASTER_KEY_FILE: /run/secrets/keeporg_master_key
+      # PostgreSQL instead of the SQLite file. The URL carries a password,
+      # so in production put it in a secret too.
+      # KEEPORG_DATABASE_URL: "postgres://keeporg:change-me@postgres:5432/keeporg?sslmode=disable"
       # The alternative, when the key comes from a store that injects
       # variables rather than files. One or the other, not both.
       # KEEPORG_MASTER_KEY: "${KEEPORG_MASTER_KEY:-}"

packaging/systemd/keeporgd.service

@@ -14,8 +14,12 @@ RestartSec=5
 StateDirectory=keeporg
 StateDirectoryMode=0700
 ConfigurationDirectory=keeporg
+ConfigurationDirectoryMode=0750
 
-# The server reads one config file and writes one data directory.
+# The server reads one config file and the master key, and writes one data
+# directory (the SQLite database) or nothing at all (PostgreSQL). The master
+# key is created by the package, not by the service, which cannot write /etc.
+UMask=0077
 NoNewPrivileges=yes
 PrivateTmp=yes
 PrivateDevices=yes
@@ -24,6 +28,14 @@ ProtectHome=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectControlGroups=yes
+ProtectKernelLogs=yes
+ProtectClock=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProcSubset=pid
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+RemoveIPC=yes
 ReadWritePaths=/var/lib/keeporg
 RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
 RestrictNamespaces=yes
@@ -31,6 +43,8 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 SystemCallArchitectures=native
 SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+SystemCallErrorNumber=EPERM
 CapabilityBoundingSet=
 AmbientCapabilities=