Recovery System Guide

Recovery System Guide

SeaViperCascade includes a recovery system intended to help restore vault access or recover encrypted vault state.

The recovery PDF flow is intended to generate a user-readable recovery kit.

This feature still needs full end-to-end testing.

Current Status

The recovery system has received security hardening, but the full user flow still needs manual verification.

Recently fixed:

• Recovery import now requires authenticated full-session access.
• Recovery import requires explicit confirmation.
• Recovery snapshot shape validation was added.
• Active sessions are revoked after recovery import/reset.
• Recovery PDF file handling was improved.

Recovery PDF

Expected safety behavior:

• User must be authenticated.
• User must explicitly confirm restore.
• Invalid snapshots should be rejected.
• Existing sessions should be revoked after restore.
• UI state should reset after restore.

Security Notes

Recovery import is one of the most dangerous flows in the app because it can alter or replace vault state.

It should always require:

• Full authentication
• Explicit user confirmation
• Strong validation
• Session revocation after success

Needs Testing

• Generate recovery PDF
• Confirm recovery code works
• Import a valid recovery snapshot
• Reject invalid recovery blobs
• Confirm sessions are revoked after import
• Confirm UI resets correctly after restore
• Confirm recovery reset behavior