List view

• Phase 3: Per-Entry Hardware Encryption

  True hardware-backed per-entry crypto. Mark sensitive entries for YubiKey-required decryption. Entry key derived directly from YubiKey PRF — no master password involved. Even master password compromise can't read hardware-encrypted entries. Multi-passkey per entry (office + backup + phone). Printed recovery key for YubiKey loss. Target: crypto holders, DevOps/SRE, security professionals.

  No due date

  •0/1 issues closed
  0% complete1 open0 closed

• Phase 2: Quick Unlock + Passkey

  Modern authentication UX. Tap YubiKey / Face ID / fingerprint instead of typing master password. Passkey encrypts master password via WebAuthn PRF, retrieves on tap. Also: store website passkeys in KDBX entries (act as passkey authenticator). KDBX format unchanged — fully compatible with KeePass/KeePassXC.

  No due date

  •1/12 issues closed
  8% complete11 open1 closed

• Phase 1: Foundation

  Simplify, modernize, and stabilize the codebase. Web-only, TypeScript, KDBX4-only, E2E tested. STATUS 2026-04-09: 13 closed / 1 open. Only remaining issue is #4 (E2E umbrella). TL warroom 2026-04-09 landed 6 additional fixes against shadow deps, stale metadata, CI masking, dead files with OAuth secrets, and test isolation bugs — commits 5f1a5f53, 5a3be1da, 243cde33, 68f44095, 164a273e, a2e39e52. Phase 1 is now foundation-complete.

  No due date

  •14/14 issues closed
  100% complete0 open14 closed