1.9 KiB
Vault + passphrase
The vault is IndexedDB database tabbot-vault on this origin only.
Cryptography
- Secrets (bot tokens, named secrets): AES-256-GCM via Web Crypto
- Unlock key: PBKDF2-SHA-256, 600,000 iterations, random salt in vault metadata
- Unlocking keeps a master key in memory. Lock drops it.
There is no HoneyPeer KMS. If you forget the passphrase and did not export a backup, the ciphertext is gone.
Remember this browser profile
Opt-in. Stores a wrapped master key so this profile can unlock without typing. Convenient on a machine you own. Dangerous on a library PC, sibling laptop, or shared profile. Prefer a dedicated browser profile for TabBot.
Reveal, copy, export, wipe
- Reveal requires unlock. Copy uses the Clipboard API and TabBot tries to clear it after 30 seconds when the browser allows.
- Export is encrypted JSON (
tabbot-vault.backup.json). It is not a plaintext token dump. Import replaces vault contents — treat it like restore. - Wipe vault deletes this origin’s database. Discord applications remain in the Developer Portal until you delete them there.
Named secrets
API keys are not project JSON. Studio → Settings → Named secrets stores namespace/name values (for example llm/apiKey, translation/apiKey) in the same AES-GCM store. Module fields typed as secret() write that vault. The runner handshake carries a bag; Code uses vault.revealSecret(namespace, name). Full workflow: Named secrets.
Do not paste those values into Discord, git, or share codes.
What is stored
Encrypted tokens, vault meta, bot projects (IR, TypeScript, module settings), KV variables, named secrets. Logs are not a second copy of the token; if a log ever showed a token, rotate it.