Reference
Security model
GitVault is built around local encryption and user-owned storage. GitHub stores encrypted files, not readable vault contents.
Security layers
| Layer | How GitVault handles it | User responsibility |
|---|---|---|
| Encryption | XChaCha20-Poly1305 authenticated encryption before sync. | Protect recovery material and unlocked devices. |
| Storage | GitHub stores ciphertext files in your private repository. | Keep the repository private and token permissions narrow. |
| Unlock | PIN and optional biometric unlock protect local access. | Use a PIN you can enter reliably and avoid sharing trusted devices. |
| Clipboard | Copied secrets can auto-clear after a configured delay. | Use short delays on shared or work devices. |
| Device trust | Linked and recognized devices are tracked in the encrypted registry. | Review devices and remove devices you no longer control. |
Unlock and lock
- 1Open the app.
The lock screen appears when authentication is required.
- 2Enter the full PIN.
Use the keyboard on web or the on-screen keypad on Android.
- 3Wait for verification.
Wrong attempts can trigger throttling before another attempt is accepted.
- 4Lock manually when needed.
Use the lock button before stepping away from an unlocked vault.
Biometric unlock
- 1Unlock with PIN first.
Biometric unlock is enabled from an already-unlocked vault.
- 2Open Settings.
Find biometric unlock in the security area.
- 3Approve the prompt.
Use biometric unlock only on devices and browsers you personally control.
Authentication interval
The authentication interval controls how often GitVault asks again after opening or returning to the app. The interval does not reset just because you open the app, so a short interval remains strict across repeated opens.
Duress mode
Duress mode uses a panic PIN for emergencies. Entering the duress PIN wipes the vault and shows decoy data. Treat this as destructive and test only with disposable data.
Clipboard auto-clear
Copied usernames, passwords, and codes can be cleared automatically after a configured delay. The OS clipboard is outside the encrypted vault, so use the shortest delay that fits your workflow.