Secura 2.0.0 – Release Notes

Secura 2.0.0 Release Notes

Release Summary

This release introduces major security improvements and new features for the vault unlock system:

1. SessionKey security fix (Breaking Change)

   • The master encryption key is no longer exposed to the renderer.
   • All sensitive operations now occur entirely in the main process.
   • Any code relying on accessing the key in the renderer will break, integrations are updated accordingly.

2. Password rate-limiting with exponential backoff (New Feature)

   • Vault unlock attempts are now protected from brute-force attacks.
   • After multiple wrong password attempts, the user is temporarily blocked.
   • Lockout time grows exponentially with each consecutive failed attempt.
   • Countdown feedback is displayed in the unlock screen to show remaining wait time.

3. Renderer type updates and UI improvements

   • window.vault.unlock now returns { success: boolean; waitTime?: number } instead of {key: Buffer|.
   • Unlock screen disables the submit button during lockout and shows a live countdown.
   • TypeScript types updated to enforce safety and prevent misuse.

---

Security Impact

• High – the SessionKey is now fully protected and never exposed outside the main process.
• Reduces risk of memory dump attacks or malicious renderer manipulation.
• Exponential backoff reduces brute-force attack risk while keeping UX friendly.

---

Changelog (Highlights)

• Breaking: SessionKey removed from renderer → secure main process storage.
• New Feature: Rate-limiting with exponential backoff for vault unlock attempts.
• New Feature: Countdown UI + submit button disable during lockout.
• Refactor / TypeScript: Updated unlock function signature in window.vault.

---

Versioning Recommendation

• Previous version: 1.0.0
• New version: 2.0.0 (Major bump due to breaking security fix)