vauly 0.2.0

Files on items, two-step login that a workspace can require, backups protected with a password, and imports that open Bitwarden's and Proton Pass's protected exports and KeePass databases as they are, files included.

Updating from 0.1.0? Read Updating vauly. The database migrations run on their own; update the CLI and the browser extension along with the server. Copies made with the Deploy to Cloudflare button update with Actions → Update vauly.

Try it: the live demo at https://demo.vauly.app (shared, resets every hour).

Deploy your own in one click: .

Install the CLI on macOS or Linux; it checks the download against SHA256SUMS:

curl -fsSL https://vauly.app/install.sh | sh

On Windows, download vauly-windows-x64.exe below and check it against SHA256SUMS.

Browser extension: vauly-extension-0.2.0-chrome.zip below. Until vauly is listed on the Chrome Web Store, unzip it and load the folder unpacked in chrome://extensions, or build it yourself as the docs describe.

Check what a vauly serves: vauly verify <url> rebuilds the commit an instance names and compares every file and security header. vauly-build.json below is this release's own build.

Known limits: no independent security audit yet, and no native mobile apps yet. Security describes the design and where it stops protecting you.

What's in 0.2.0

Added

• Files on items, such as TLS certificates, key files and recovery-code PDFs, up to 10 MB each.

  • Encryption. Each file is encrypted in the browser, a chunk at a time, with a key of its own. That key and the file's name are sealed with its item's key.
  • Storage. Files are kept in the D1 database, so a one-click deploy needs no bucket. All files together can take 200 MB by default; FILES_MAX_MB and FILES_TOTAL_MB change both limits.
  • Who does what. Viewers download files; editors add, rename and remove them. Every step is logged.
  • Deleting. An item in Recently deleted keeps its files, and they go when it does.
  • Where they don't go. Share links don't carry files, and the offline copy keeps their names but not their contents.
  • Agents get a file through a reference like vauly://…/files/<name>, and only when the approval says its files go too. vauly run hands the command the file's path, in a folder only your user can read, and deletes it afterwards. A one-time grant used for files lasts until its run's downloads end, about 15 minutes. Until then, the item lists the agent as "finishing a run until" that time, with its switch.

• Owners and admins can require two-step login for everyone, in Settings › Workspace, once they have it themselves.

  • Members without it are asked to set it up at their next sign-in or unlock, and new members as they join. Until they have, the server refuses everything else.
  • The Members page marks who still needs it, and admins hear on their devices when someone sets it up.
  • Agents keep working, since they use their token rather than a member's sign-in.
  • Sessions. Turning on two-step login now signs out your other sessions, and an admin resetting it signs the member out everywhere.

• Download a backup protects the backup with a password you choose, by default.

  • The format. It's Bitwarden's password-protected export, made with vauly's Argon2id settings, so vauly and Bitwarden both import it.
  • The password needs a master password's strength, and can't be the master password itself.
  • With files, a backup is a ZIP of the export and the files, each file encrypted with a key of its own. Only the export holds their names and keys.
  • The activity log says when a backup was protected. Turning the password off gives the plain CSV, or ZIP, as before.

• Imports open protected exports: Bitwarden's password-protected .json (Encrypted) export and Proton Pass's PGP-encrypted export. vauly asks for the file's password, opens the file in the browser, and doesn't keep the password, so the export never has to sit in plain text.

• KeePass and KeePassXC databases import as they are.

  • Drop the .kdbx file, enter its password and choose its key file. There's no XML export first.
  • vauly opens the database in the browser, in a worker that can't connect anywhere. It reads KDBX 3.1 and 4, with AES-KDF, Argon2d or Argon2id.
  • It turns away a database whose key settings ask for more than 1 GiB of memory, or that unpacks to more than 256 MB.

• Imports bring files from three places:

  • 1Password's Documents and the files attached to its items, from the 1PUX.
  • Bitwarden's attachments, from its ZIP export.
  • KeePass's and KeePassXC's attachments, from a database or its XML export.

  Files over the instance's limit stay behind, and the review names them.

• Notifications. Turn them on for each device in Settings.

  • What they tell you: when an agent asks for an item you can approve, and when your account signs in from another browser.
  • What they say: the agent's name and how many items it asked for, never an item's name. They're encrypted to the device.
  • When they stop: when that device is signed out. An agent's requests notify at most once every five minutes.
  • On iPhone and iPad they need the app added to the Home Screen, on iOS 16.4 or later.

• Settings › About shows the version of vauly and the commit it was built from, and /vauly.json reports them.

Changed

• Update vauly goes to the latest release by default.
  • It used to take whatever was on main, including changes that weren't released yet.
  • Its version input picks a release, or next, the development branch. It never moves a copy back to an older version, and it does nothing when the copy is already on the version asked for.
  • To get these, a copy replaces its workflow once; see Updating vauly.
• Branches. main now holds only the latest release. Development happens on next, which carries the next version with -dev, such as 0.3.0-dev, and Settings › About says so on a copy built from it.

Fixed

• The service worker is the same wherever the web app is built, so vauly verify --against a release's manifest matches every instance of that release. It used to list its files in the order the build machine's file system gave them. CI now builds the app on macOS as well as Linux and compares.
• After another device signs this one out, the app says "You were signed out" once, not once for every request that was on its way.
• The extension's Settings shows whether your vauly has logos turned off as soon as the popup hears, instead of what it said before the popup opened.

Security

• Moving an item to another vault re-checks which agents can use it. An agent keeps the item only if the person it acts for can open the new vault. A migration also takes away anything agents kept from earlier moves, along with open requests for it.
• Better Auth's own routes for changing the password and the account's name are turned off. vauly's own do both: changing the master password swaps the sealed key along with the sign-in hash, and the workspace's rules apply.
• Import checks what a ZIP says it unpacks to before unpacking it. It refuses a ZIP whose export would take more than 256 MB, and leaves behind the files past that, so a damaged ZIP can't take the tab's memory first.