🛡️ Aegis Vault v0.2.0 — Hardened Security Release
Aegis Vault v0.2.0 is a major security hardening release. This update successfully resolves multiple critical, high, and medium-severity security findings identified during our latest static code analysis and cryptographic audit. We have completely eliminated plaintext credential caching in RAM, strengthened file attachment encryption, isolated biometric tokens, and established a fully automated multi-platform build pipeline with integrity verification.

We highly recommend all users to upgrade to v0.2.0 immediately.

🔒 Security Hardening & Vulnerability Fixes (Audit Resolves)
This release implements professional-grade mitigations for the following audit findings:

RAM Memory Isolation (Z-01 & Z-08 - Resolved): Removed all plaintext Master Password string caches from memory. Credentials and Derived Keys are now held exclusively in raw Uint8Array buffers and are securely zeroized (.fill(0)) instantly upon vault lock or logout. In-memory password strength (zxcvbn) caches are now also cleared on lock.
Cryptographic Key Protection (Z-02 - Resolved): Replaced raw symmetric key hex mappings in the WebCrypto cache with SHA-256 hashed unique identifiers, eliminating symmetric key disclosure via memory heap dumps.
Hardened Attachment Encryption KDF (Z-03 - Resolved): Upgraded file attachment key derivation from a simple SHA-256 hash to a standard-compliant HKDF-SHA-256 context-bound scheme. Legacy attachments are automatically migrated to the new secure format.
Nonce Collision Mitigation (Z-04 - Resolved): Implemented a deterministic, counter-based IV generator complying with NIST SP 800-38D (8-byte random session prefix + 4-byte monotonic counter) to prevent AES-GCM nonce reuse under any circumstances.
Sandboxed Biometric Metadata (Z-06 - Resolved): Completely removed WebAuthn biometric salts and wrapping keys from insecure localStorage. All biometric configurations are now fully isolated inside a private, sandboxed IndexedDB instance.
Downgrade Attack Protection (Z-10 - Resolved): Hardened the secure backup import engine. Imports with weakened Argon2id KDF parameters (manipulated to speed up brute-force operations) are now strictly rejected (memoryKiB >= 65536 and iterations >= 3 enforced).
Security Event Visibility (Z-05 - Mitigated): Integrated event logging warnings (security.legacyCryptoWarning) to audit and flag whenever deprecated/legacy cryptographic envelopes are handled.
PRNG Optimization (Z-07 - Resolved): Replaced modulo reduction with unbiased rejection-sampling in token generation, eliminating modular statistical bias.
Secure Default Lock (Z-09 - Resolved): Set default auto-lock duration to 300 seconds (5 minutes) instead of indefinite, mitigating physical access risks out of the box.
🚀 CI/CD & Multi-Platform Desktop Builds
We have established a unified, automated GitHub Actions CI/CD pipeline building native packages for three major desktop platforms:

Windows: MSI installer, NSIS Setup, and Portable executables.
macOS: Universal Apple Silicon (M-series) + Intel architecture binary packaged in a .dmg installer.
Linux: Debian/Ubuntu .deb installer and portable .AppImage bundle.
📝 Verification & Integrity (SHA-256 Checksums)
Every release build includes a signed/authenticated SHA256SUMS.txt listing the cryptographic digests of each installer. You can verify the integrity of your download by running the following commands in your terminal:

Windows (PowerShell):

powershell
Get-FileHash -Algorithm SHA256 <installer_name>
macOS & Linux (Bash):

bash
sha256sum -c SHA256SUMS.txt

Or:

shasum -a 256 <installer_name>
🔧 Installation Guidelines
Windows
Run the MSI installer or NSIS setup to install Aegis Vault on your system, or run the portable .exe directly.
macOS
Open the .dmg file and drag Aegis Vault 7 into your Applications folder.
Note: Since the binary is self-compiled, you may need to right-click the app and choose "Open" to bypass Gatekeeper on first launch.
Linux
Debian/Ubuntu: Install the .deb package via sudo apt install ./aegis-vault-7_0.1.0_amd64.deb.
AppImage: Make it executable via chmod +x Aegis_Vault_7_0.1.0_amd64.AppImage and run.