BitLock

BitLock is an online zero-knowledge vault. Passwords, notes, TOTP secrets, crypto keys, and recovery codes are encrypted in the browser before they are sent to the server. The hosted database stores ciphertext and the metadata required to operate the account.

Features

• Username-based accounts with legacy email sign-in compatibility
• AES-256-GCM encryption with a PBKDF2-derived key
• Passwords, links, encrypted notes, TOTP, crypto secrets, and recovery codes
• Multiple vaults, folders, tags, favorites, search, and item history
• Encrypted .bitlock backup import/export
• Password strength and reuse audit performed in the browser
• Revocable browser-extension token
• Voluntary Support page for disclosed sponsors and affiliate links
• French and English interface

Stack

• Nuxt 3, Vue 3, Tailwind CSS
• Turso/libSQL in production
• Vercel Nitro preset
• nuxt-auth-utils encrypted session cookies

Local development

Install dependencies and start Nuxt:

bun install
bun run dev

Without TURSO_DB_URL, development uses bitlock-dev.db in the project root. The file is ignored by Git.

Copy .env.example to .env and set a session password of at least 32 characters:

NUXT_SESSION_PASSWORD=replace-with-a-long-random-secret
TURSO_DB_URL=libsql://your-database.turso.io
TURSO_DB_TOKEN=your-token
APP_URL=http://localhost:3000
# Optional: set [] to hide the public partner catalogue.
SUPPORT_CATALOG_JSON=[]

Support catalog

The Support page includes the disclosed PokePings partner offers. Configure a different catalogue privately through SUPPORT_CATALOG_JSON, or set it to [] to hide all partner links. The client never receives the environment variable itself, only validated entries from /api/support/catalog.

[
  {
    "id": "partner-id",
    "kind": "affiliate",
    "title": "Partner name",
    "description": "What the visitor will find after opening the link.",
    "url": "https://partner.example/path",
    "disclosure": "Affiliate link — BitLock may receive a commission."
  }
]

Only HTTPS destinations are accepted. Links open after an explicit user action with rel="sponsored noopener noreferrer". No advertising SDK or third-party analytics script is loaded inside the vault.

Database

Create or update the Turso schema:

bun run db:migrate

The runtime also performs idempotent compatibility migrations. Existing hosted accounts keep their original email identifier for sign-in while receiving a unique username. New accounts are username-only.

Validation

bun run test
bun run build

For the API smoke test, start the app first and run:

bun run test:smoke

Deployment

Set NUXT_SESSION_PASSWORD, TURSO_DB_URL, TURSO_DB_TOKEN, and APP_URL in Vercel, then deploy. SUPPORT_CATALOG_JSON is optional.

License

MIT — KernelStudio by Enzo.