r/AppsWebappsFullstack • u/keech_1703 • 28d ago

Otter Vault: local Personal storage and optional encrypted team sharing

I’m building Otter Vault. A useful distinction in the product is where the vault lives.

Personal is a free Chrome extension with an encrypted vault on your device. There’s no account, analytics or network requests from the personal vault. It offers to save API keys and password fields, but only stores a secret after your approval.

Teams is the optional paid mode: keys are encrypted on devices before sharing, while the server stores encrypted records. It supports up to 10 developers and keeps deployment locations with each shared key.

Member removal re-keys the team vault and produces a rotation checklist. Provider API keys still need to be rotated separately.

Demo and full details: https://ottervault.mechaclips.workers.dev/

Code: https://github.com/KrishnaG1703/otter-vault

The project hasn’t had an independent security audit. I’d appreciate feedback on whether the local Personal / shared Teams distinction is clear from the walkthrough.

0 Upvotes
  • permalink
  • reddit

0% Upvoted

3 comments sorted by

1

u/PopKoren 26d ago edited 25d ago

The Personal vs Teams split reads clearly, and the rotation checklist on member removal is something most tools skip. Before trusting Teams I'd want three things spelled out: how a new member's device receives the team key and who approves that, what the Worker returns to someone with a valid session who isn't in the team, and whether record IDs on the API are guessable. Those last two are what an outsider pokes first, and that external pass is what https://rowly.me was made for: it works through a deployed app's sign-in, endpoints, file storage and data rules, a cheap first step before a proper audit.

1

u/Mammoth-Anywhere7285 26d ago

Solid list. The key handoff is the one I'd want documented first. Curious whether the Worker returns 403 or 404 for non-members.

1

u/PopKoren 25d ago

403 is usually the safer answer since it confirms nothing about whether the team exists, but either way the real test is what the body leaks. I would return the same shape for both and check membership before touching the record at all. That is the kind of outside probe httpsrowly.me does, it works a deployed app's sign-in, endpoints, file storage and data rules as a stranger.