34 lines
1.9 KiB
Markdown
34 lines
1.9 KiB
Markdown
# Vault + passphrase
|
||
|
||
The vault is IndexedDB database **`tabbot-vault`** on **this origin only**.
|
||
|
||
## Cryptography
|
||
|
||
- Secrets (bot tokens, named secrets): **AES-256-GCM** via Web Crypto
|
||
- Unlock key: **PBKDF2-SHA-256**, **600,000** iterations, random salt in vault metadata
|
||
- Unlocking keeps a master key in memory. **Lock** drops it.
|
||
|
||
There is no HoneyPeer KMS. If you forget the passphrase and did not export a backup, the ciphertext is gone.
|
||
|
||
## Remember this browser profile
|
||
|
||
Opt-in. Stores a wrapped master key so this profile can unlock without typing. Convenient on a machine you own. **Dangerous on a library PC, sibling laptop, or shared profile.** Prefer a dedicated browser profile for TabBot.
|
||
|
||
## Reveal, copy, export, wipe
|
||
|
||
- Reveal requires unlock. Copy uses the Clipboard API and TabBot tries to clear it after 30 seconds when the browser allows.
|
||
- **Export** is encrypted JSON (`tabbot-vault.backup.json`). It is not a plaintext token dump. Import replaces vault contents — treat it like restore.
|
||
- **Wipe vault** deletes this origin’s database. Discord applications remain in the Developer Portal until you delete them there.
|
||
|
||
## Named secrets
|
||
|
||
API keys are **not** project JSON. Studio → **Settings → Named secrets** stores `namespace/name` values (for example `llm/apiKey`, `translation/apiKey`) in the same AES-GCM store. Module fields typed as `secret()` write that vault. The runner handshake carries a bag; Code uses `vault.revealSecret(namespace, name)`. Full workflow: [Named secrets](/docs/guide/named-secrets).
|
||
|
||
Do not paste those values into Discord, git, or share codes.
|
||
|
||
## What is stored
|
||
|
||
Encrypted tokens, vault meta, bot projects (IR, TypeScript, module settings), KV variables, named secrets. Logs are not a second copy of the token; if a log ever showed a token, rotate it.
|
||
|
||
See also [Privacy](/legal/privacy), [Security](/legal/security), and [Community](/docs/guide/community).
|