Sun, 12 Apr 2026 02:22:13 +0000
infosec, appsec, pgp, selfhosted

Full OWASP Top 10 security review completed for PGP Vault v2.3.0:

• Double-submit CSRF protection on all forms
• Parameterized SQL (no injection)
• List-form GPG args (no shell injection)
• Passphrase files instead of command-line args
• 5-fail login lockout per IP
• Self-signed HTTPS with auto-generated CA

Audit results are public in the GitHub releases.