VaultKeepR/vaultkeepr-public

What it is

vaultkeepr-public is the MIT-licensed part of VaultKeepR, a zero-knowledge password manager. It holds the SDK packages shared by every VaultKeepR client and the Solidity contracts on Base L2. The web app, browser extension and iOS/Android apps are in a private repository, so only the building blocks can be audited or reused. The page's package table was not in the fetched text, so individual package names beyond @vaultkeepr/core are not listed here.

How it works

The page makes these design claims. It does not show the code behind them.

• The master password never leaves the device.
• Encryption is XChaCha20-Poly1305 AEAD with Argon2id key derivation (t=3, m=64 MiB, p=4).
• Ciphers, curves and hashes come from @noble/*. Ethereum types and clients come from viem.
• An on-device small language model (SLM) engine does auto-tagging and breach summaries, and the page says no vault data reaches a server.
• Keys, CIDs and addresses are redacted at the logger level.
• docs/THREAT_MODEL.md documents assets, adversaries, trust boundaries and accepted limitations. The accepted limitations are the part to read before relying on the design.

Preconditions / Affected

Building needs Node.js 20+ and pnpm 9+. Foundry is needed only for the contracts. The workspace uses Turbo (turbo.json) and pnpm workspaces.

What to do

To use the SDK:

npm install @vaultkeepr/core

To build and test the workspace:

pnpm install
pnpm build
pnpm test

To test the contracts:

cd contracts
forge install
forge test

Report vulnerabilities by following SECURITY.md.

Caveats

• SDK packages version independently and are published per package with pnpm publish. Check each package's npm badge for its current version.
• Repository tags (vX.Y.Z) cover the full workspace and client artifacts. Only client releases (browser extensions, mobile) are minisign-signed. The page does not say the npm packages are signed.
• The clients are private, so the page gives no way to check that they use these packages as described.