Architecture

Architecture

Monorepo layout:

apps/
	server/   Fastify + SQLite + Crypto + Playwright + PDFKit
	web/      React + Vite dashboard and mobile view
	desktop/  Electron wrapper for local packaged runtime

Backend Stack

• Fastify API server
• better-sqlite3 local DB
• Node crypto (scrypt KDF + AES-256-GCM)
• Playwright automation runtime
• PDFKit for recovery kit generation

Frontend Stack

• React + TypeScript + Vite
• Themed split-pane dashboard
• QRCode rendering for mobile sync
• Fontsource typography bundle for a distinctive visual style

Desktop Stack

• Electron shell for bundled local desktop runtime
• electron-builder packaging (NSIS installer target on Windows)

Security Model

1. Master password is never stored.
2. Master password is transformed with scrypt into a 256-bit key.
3. Database stores:
   • Encrypted canary string (auth_success) for unlock validation.
   • Wrapped Data Encryption Key (DEK) encrypted by master-derived key.
   • Wrapped DEK encrypted by recovery-derived key.
4. Usernames/passwords/notes are stored in a local encrypted vault SQLite database using DEK (AES-256-GCM).
5. Active DEK is held only in RAM for active sessions.
6. Lock/revoke wipes session key material from memory.

Recently Fixed

• Unauthenticated recovery import vulnerability
• Unsafe default LAN exposure
• Overly permissive CORS policy
• Mobile QR token over-privilege
• Recovery reset session persistence vulnerability
• Unsafe URL validation and automation target risks
• Automation job exposure and secret persistence risks
• Raw internal error leakage
• Weak CSV/logo/theme/recovery input limits
• Missing security headers and CSP protections
• Recovery PDF file handling and persistence risks
• better-sqlite3 / Electron runtime compatibility issues
• Node runtime and contributor build inconsistency

Not Yet Audited

SeaViperCascade has not received a formal independent security audit.

Security-sensitive areas still needing review:

• Cryptographic implementation
• Recovery flows
• Mobile sync
• Desktop/Electron boundaries
• Automation engine
• Vault persistence
• Import/export handling

Notes

• The recovery code should be stored offline.
• If you lose both master password and recovery code, vault decryption is not possible by design.