This document outlines the security architecture, threat model, data isolation practices, and guidelines for maintaining a clean, secret-free repository for IndexArc.

As a portable personal vault, maintaining maximum security for user data and zero-exposure for API keys, passwords, and private tokens is a core architectural pillar of IndexArc.

IndexArc is designed with a local-first, local-only by default security posture.

• Cipher: AES-256-GCM (Galois/Counter Mode), providing authenticated encryption with strong integrity guarantees.
• Key Derivation: Derived from the user's master password using PBKDF2-HMAC-SHA256 with 100,000 iterations.
• Salts and IVs: Each encrypted file (e.g., vault.json, vectors.json) uses a cryptographically secure, unique salt (re-used for stable PBKDF2 keys per file) and a fresh 12-byte IV for every write.
• Lock State: Locking the vault purges the derived encryption key from the server process memory (nulls out the key). Unlocking must be explicitly triggered by the user via password entry.

• Localhost Binding: The Express server binds exclusively to 127.0.0.1 (localhost). It does not accept remote incoming network traffic.
• No Direct UI Storage Access: The React frontend has no direct permission to read or write disk files or interact directly with raw AI APIs; all calls are mediated by the localhost Express server over a ping-gated port.
• AI API Routing: Credentials for external cloud providers (such as Gemini, Groq, OpenRouter, Anthropic, or custom OpenAI endpoints) are stored locally in the portable settings file and injected only during backend API calls. They are never sent back to the frontend UI or exposed in server logs.

We enforce a strict Zero-Secrets Policy for the IndexArc Git repository. No actual vault data, settings, logs, .env configurations, or private API keys must ever be committed to the repository history.

A full security sweep has been performed on the entire repository and historical commit logs.

• Result: 100% Clean. No secrets, active API keys, raw password parameters, or personal data files exist in the tracked code or past git commits.
• Excluded Metadata: IDE and developer agent metadata (such as .zcode/) are ignored to keep the commit logs uncluttered and strictly focused on production source code.

The project uses an extensive .gitignore specification to prevent accidental commits of local state. The following files are never tracked by Git and are excluded from the packaged Desktop builds:

To maintain a secure repository, please adhere to the following best practices during development:

If you need to use an active cloud API key during backend testing, place it inside a local .env file in the project root:

GEMINI_API_KEY=your_actual_api_key_here

Dotenv is configured locally and will inject this override for development without writing keys into config/settings.json or tracking them.

Always review your diffs before committing:

# Review exact diffs staged for commit
git diff --cached

Check that no real settings, credentials, or databases are listed as additions.

When writing backend logic or service providers, ensure that log statements do not print raw secret payloads:

// 👍 Safe (logging metadata/count)
addLog("DB", `Successfully loaded ${entries.length} vault entries.`);

// 🚫 Unsafe (never print active credentials or raw values)
addLog("API", `Sending request with key: ${apiKey}`); // NEVER DO THIS

If you discover a security vulnerability or security-related bug in IndexArc, please do not open a public issue. Instead, report it privately by contacting the maintainers directly or emailing b.alfaris@gmail.com. We will address all verified vulnerability reports promptly.