Kennword 0.3.1

Changes since 0.3.0

A security release. Please update.

• Security: paths that the web server in front of PHP restricts, such as /admin, could be reached with
  a percent-encoded or capitalised script name before them
  (GHSA-q6jg-vj22-6hm8).
  Kennword now keeps such a path whole and answers 404, like Vaultwarden.
• Dependencies: symfony/filesystem, symfony/http-foundation, symfony/http-kernel and
  symfony/routing 8.1.11, which fix the advisories composer audit reports for 8.1.9 and 8.1.10.

Updating from 0.3.0

Update as the installation guide
describes; nothing else changes. Kennword 0.3.1 follows the same Vaultwarden release (1.37.5) and uses the
same database and settings.

Kennword is in early development and has not been independently audited. Do not trust it with real passwords
yet; try it with test accounts or with a copy of your data.

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check kennword-0.3.1.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

What's Changed

• Name security@kennword.org in the security policy by @christianrudde in #10
• Give the README a header with the wordmark by @christianrudde in #11
• Update four Symfony components to 8.1.11 by @christianrudde in #12
• Keep encoded and capitalised script names in the path by @christianrudde in #13

Full Changelog: v0.3.0...v0.3.1

Kennword 0.3.0

Changes since 0.2.0

Vaultwarphpen is now Kennword. The old name borrowed Vaultwarden's. Kennwort is German for password;
Kennword keeps the German "kenn" (to know) and makes the rest English. Nothing else changed: Kennword 0.3.0
behaves like 0.2.0, follows the same Vaultwarden release (1.37.5) and uses the same database and settings.

• Repository: github.com/Lumundi/kennword. The old addresses redirect.
• Composer package: lumundi/kennword. The old package christianrudde/vaultwarphpen stays at 0.2.0 and
  will be marked abandoned.
• Release archives: kennword-<version>.tar.gz and .zip.
• Artisan commands, without aliases: vaultwarden:migrate, check, schedule, job, notifications and
  web-vault are now kennword:migrate, kennword:check, kennword:schedule, kennword:job,
  kennword:notifications and kennword:web-vault.
• Clients and logs: /api/config and the admin diagnostics name Kennword and link to the new repository;
  log lines use the target [kennword].

Updating from 0.2.0

Update as the installation guide
describes, then change the command names wherever they are called:

• the cron line: php artisan kennword:schedule --once
• the services of the scheduler and the live notifications: php artisan kennword:schedule and
  php artisan kennword:notifications

Kennword is in early development and has not been independently audited. Do not trust it with real passwords
yet; try it with test accounts or with a copy of your data.

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check kennword-0.3.0.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

What's Changed

• Rename the project to Kennword by @christianrudde in #9

Full Changelog: v0.2.0...v0.3.0

Vaultwarphpen 0.2.0

Changes since 0.1.4

Vaultwarphpen now follows Vaultwarden 1.37.5 (before: 1.37.4 and the fixes after it) and serves its web vault,
2026.10.1. PARITY.md shows the state of each item.

From Vaultwarden 1.37.5:

• Fill Assist: the setting FILL_ASSIST_RULES_URL, its address in /api/config, the client feature flag
  fill-assist-targeting-rules and the Fill Assist organization policy, which needs the single organization
  policy and an HTTPS rules URL.
• TWO_FACTOR_REMEMBER_DAYS (1 to 90, default 30) sets how long a remembered two-step login lasts.
• Registration: the link of the verification mail is checked before the form opens
  (/identity/accounts/register/verification-email-clicked).
• Deleted accounts are signed out of their clients, live and through the push relay.
• Fixes: bulk member actions no longer show internal error details; a login request stands in for the
  password when sending an email code only if it is approved, unused and recent; USER_SEND_LIMIT counts the
  size of file Sends only; Send file data must be an object; moving several items updates the revision once;
  devices are unregistered at the push relay the way it now expects; revocations by the two-step login and
  single organization policies log events of their own.
• Logs: values from requests are escaped, the password hint and the other errors Vaultwarden keeps quiet no
  longer reach the log, and SSO logs the identifier of the user, the whole of it only with SSO_DEBUG_TOKENS.

Also:

• Favicons: the tokenizer follows html5gum 0.9.0, which Vaultwarden 1.37.5 uses.
• A difference from Vaultwarden: after the account key is rotated, Vaultwarden 1.37.5 refuses new items from
  clients 2026.10 and later ("Invalid key cipher", reported as
  dani-garcia/vaultwarden#7927). Vaultwarphpen, like
  Bitwarden's server, replaces the id of the user key with the rotation
  (Configuration).

When updating

• Install the new web vault (php artisan vaultwarden:web-vault), unless you update from a release archive,
  which brings it; then restart the scheduler and the notifications daemon, as
  Updating says.
• FILL_ASSIST_RULES_URL must be an HTTPS URL without credentials, query, fragment or surrounding white space,
  and TWO_FACTOR_REMEMBER_DAYS between 1 and 90. Like Vaultwarden, the server does not start with other values.
• An account whose key was rotated with clients 2026.10 or later before this update still has the old key id,
  and its new items keep failing. Clear it once, after a backup of the database:
  UPDATE users SET key_id = NULL WHERE email = '…'; The next login records the new id.

Vaultwarphpen 0.1.4

Changes since 0.1.3

One security fix, reported by a static audit of 0.1.3. Updating is recommended where other users share the
host. docs/security-review.md
describes it (finding 16).

• Notifications daemon: the channel between the web requests and the daemon was open to every user on
  the host. Without the key nobody could send a message the daemon accepts, but connections that sent
  nothing could fill the channel, and live sync stopped. The Unix socket is now open to the daemon's user
  and group only (0660), connections that send no signed line within five seconds are closed, every line
  carries its time and a nonce and is accepted only once, and a TCP channel (NOTIFICATIONS_SOCKET) listens
  only on loopback or other non-public addresses.

When updating

• Restart the notifications daemon after the update, as Updating
  says, so that it creates the socket with the new permissions.
• PHP must reach the socket as the daemon's user or through its group. The installation guide runs the
  daemon as the user PHP runs as, which needs no change.
• A daemon set to listen at tcp://0.0.0.0:…, tcp://[::]:…, a public address or a host name other than
  localhost no longer starts. Use a loopback address such as tcp://127.0.0.1:3013, on both sides.

As since 0.1.2, PHP 8.5.12 or newer is required.

Downloads

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check vaultwarphpen-0.1.4.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

Full Changelog: v0.1.3...v0.1.4

Vaultwarphpen 0.1.3

Changes since 0.1.2

Security fixes from a second internal review. Updating is recommended.
docs/security-review.md
describes each finding (9 to 15).

• No routes below /index.php/. Every route also answered with the script name in front of it, for
  example /index.php/admin, so a web server rule that keeps /admin to some addresses did not apply.
  Such paths now get a 404, as in Vaultwarden.
• Notifications daemon: one request with more query fields than PHP's max_input_vars ended the
  daemon and every live connection. It now parses the query itself.
• Settings: saving them in the admin panel rewrote config.json in place, and requests in between ran
  without it. The file is now replaced in one step and keeps its permissions.
• Request bodies are limited like Vaultwarden's: JSON up to 20 MB, forms up to 32 KiB, 413 above that.
• Method override only Rocket's way, through a leading _method form field; the query string and the
  X-HTTP-Method-Override header no longer change the method.
• Tokens: a wrong admin token against an Argon2 hash is verified once instead of twice, and token
  signatures are only accepted in their canonical base64url spelling.
• Installation guide: set display_errors = Off and a small max_file_uploads in PHP, and limit
  request bodies in the web server (LimitRequestBody for Apache), since PHP stores the files of any
  upload request before Vaultwarphpen sees it.
• Tests: the end-to-end tests with the official clients also log in with SSO.

As since 0.1.2, PHP 8.5.12 or newer is required.

Downloads

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check vaultwarphpen-0.1.3.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

Full Changelog: v0.1.2...v0.1.3

Vaultwarphpen 0.1.2

Changes since 0.1.1

• Vaultwarden's fixes after 1.37.4: Vaultwarphpen now follows Vaultwarden commit
  64ae55c
  and ports its three changes:
  • The v2 API checks the storage limit when it reserves an attachment. Before, reservations alone could
    use up the quota of a user or an organization.
  • Updating a cipher cannot move it into an organization; only sharing can. The /admin routes take
    organization ciphers only. Sharing needs an organization and at least one collection. A personal
    import ignores organization IDs.
  • The clients hear about a new attachment when it is reserved, not again after the upload.
• PHP 8.5.12 or newer is required. It fixes heap buffer overflows in the URL parser that the HTTP
  client and the icon service use for addresses from outside. Update PHP before you update
  Vaultwarphpen: Composer's platform check refuses older releases.
• Dependencies: Laravel 13.39, Symfony 8.1.10; PHPUnit 13 for the tests.

Downloads

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check vaultwarphpen-0.1.2.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

Full Changelog: v0.1.1...v0.1.2

Vaultwarphpen 0.1.1

Changes since 0.1.0

• Notifications daemon: it now stays within its memory and file descriptors under load. Frames,
  requests, connections and unsent output are limited, so a few clients can no longer take it past
  memory_limit (security review).
• Local times in the admin panel and in mails follow the server's time zone (TZ, else
  /etc/localtime), as in Vaultwarden. Before, they were always UTC.
• php artisan vaultwarden:check examines a copy of a Vaultwarden installation before the move: settings,
  data folder, RSA key, schema, and rows that cannot be read. It prints only counts and names
  (Moving from Vaultwarden).
  The release archives now include parity/schema, which the check compares against.
• .env.example starts with production settings and lists Vaultwarden's most important settings.
  The README and the installation, configuration and migration guides are up to date.
• Tests:
  • the official web vault and CLI are tested end to end against both servers
  • moving an installation from Vaultwarden and back is tested on SQLite, MySQL and PostgreSQL

Downloads

Archives for PHP hosts without Composer: the code with its dependencies in vendor/ and the web vault
that Vaultwarden ships in web-vault/. Installing from a release archive
describes the installation and the update; sha256sum --check vaultwarphpen-0.1.1.sha256 checks the downloads.

The web vault is Vaultwarden's build of the Bitwarden web client, under the GPL-3.0. Its source is attached
as web-vault-*-source-*.tar.gz; NOTICE.md
says where it comes from.

Full Changelog: v0.1.0...v0.1.1