Security release after a full review of the server, the web vault and the browser extension (code reviews, Semgrep, Trivy, Gitleaks, gosec, govulncheck, nmap and a live scan). Updating is recommended.
Security
- Browser extension: new logins, authenticator keys and passkeys saved from the extension could land in a team vault instead of your own vault when the team vault's items came first. They now always go into your own vault.
- Four-eyes principle: an administrator could approve their own request when many requests were waiting, and could switch the rule off by demoting or disabling the other administrator. Both are closed: nobody approves their own request, and demoting or disabling an administrator waits for approval too.
- Temporary rights from an access request could be made permanent by their holder. Nobody can change their own access now, and a vault always keeps a permanent manager.
- Ending access now takes effect at the exact time (before: up to 5 minutes later).
- Access log: moving an item into your own vault no longer shows its log from the team vault.
- Storage limit: parallel uploads could exceed it, and secret links did not count. Both are fixed.
- Locking now clears every open window with decrypted data, and locks the other vault tabs too.
- Filling: without asking, the extension fills only a login saved for the same address (host and port). Another address of the same website asks first.
- Passkeys: PassZit no longer claims that you verified yourself. A website that wants a passkey PassZit already has is told only after you confirm. Nothing is answered while the extension is signed out, and IP addresses are refused.
- Confirmed key fingerprints are never lost after a loading error. Emergency contacts get the same key check as vault members.
- Single sign-on (OIDC) refuses e-mail addresses the identity provider has not confirmed.
Fixes
- Documentation: two people editing the same page no longer overwrite each other, and pictures are kept.
- Export leaves out team vaults where you may only connect and fill. In CSV, cells that look like spreadsheet formulas are quoted.
- Import of a PassZit file no longer takes over references to the original items' files.
- Clipboard clearing retries when the page gets focus again.
- Open with from WatchZit puts the password on the clipboard when the program asks for it. After unlocking, it opens only from its own window and only on the same console.
