SecureVault is a client-side file encryption portfolio project built with React, TypeScript, Web Crypto, and IndexedDB. It opens directly to a cyberpunk dashboard and lets visitors try the complete workflow without creating an account.
SecureVault demonstrates a security-sensitive browser application with a documented file format, explicit trust boundaries, browser-level tests, and an automated GitHub Pages release pipeline.
- AES-256-GCM authenticated file encryption
- PBKDF2-SHA256 key derivation with 600,000 iterations
- Authenticated
.securev2 archives with encrypted private metadata - Local IndexedDB Vault with import, search, decrypt, download, and delete workflows
- ECDSA P-256 / SHA-256 message signing demo
- Responsive cyberpunk interface with reduced-motion support
- Content Security Policy, dependency audit, and production artifact smoke tests
File contents, passwords, and signing private keys never leave the browser. The application has no backend, analytics, account system, or built-in secrets.
Requires Node.js 22.12 or later and npm.
cd frontend
npm ci
npm run devOpen the localhost URL printed by Vite. Web Crypto requires a secure context; localhost and HTTPS satisfy that requirement.
Run every local quality gate with:
cd frontend
npm run lint
npm run typecheck
npm test
npm run build
npm audit --audit-level=high- Push a change to the repository's
mainbranch. - Open Settings → Pages and set Source to GitHub Actions when configuring a fork for the first time.
- The
Quality and deployworkflow validates the app, builds it with the repository base path, tests the production artifact, and publishes it.
The app uses hash routes, so dashboard URLs remain reload-safe on static hosting. The deployment URL appears in the repository's Deployments section after the workflow succeeds.
New .secure v2 downloads encrypt the original content, filename, MIME type, size, and creation timestamp. The local Vault keeps a separate plaintext index copy of filenames, sizes, timestamps, algorithms, and archive metadata so the interface can search and sort records. The activity log is also plaintext local browser data. Anyone who can access or modify that browser profile can inspect or alter this local index and log.
SecureVault is a portfolio demonstration and has not received an independent cryptographic audit. Read SECURITY.md before using it with sensitive data.
Released under the MIT License.