feat(vault): add key-version header and rotation keyring support (#1770) by trivikramkalagi91-commits · Pull Request #2051 · utksh1/SecuScan

trivikramkalagi91-commits · 2026-07-21T05:00:35Z

Description

Refactor VaultCrypto in backend/secuscan/vault.py to add explicit key-version headers, rotation keyring support, collision-safe legacy fallback decryption, key ID extraction, and strict payload length guards.

Key Technical Enhancements

Wire Format Specification (Version 1):
Prepend magic header b"SV1:" (4 bytes) and raw key fingerprint (8 bytes) to newly encrypted blobs:
$$\text{Wire Format} = \text{b"SV1:"}(4) ;||; \text{key_id_bytes}(8) ;||; \text{nonce}(12) ;||; \text{ciphertext} ;||; \text{auth_tag}(16)$$
Zero-Downtime Key Rotation & Keyring:
Updated VaultCrypto.__init__(key, fallback_keys=[...]) to maintain an internal $\mathcal{O}(1)$ keyring lookup dictionary (_keyring: Dict[bytes, AESGCM]). Decryption extracts the key ID from the header to look up the correct key instantly without trial-and-error GCM tag failures.
Collision-Safe Legacy Fallback Protocol:
If versioned decryption fails or if a legacy random 12-byte nonce coincidentally starts with b"SV1:" (1 in $2^{32}$ probability), decrypt() automatically falls back to attempting legacy decryption (nonce(12) || ciphertext), guaranteeing zero false-positive decryption failures for pre-existing secrets.
Out-of-Band Key ID Extraction:
Added VaultCrypto.extract_key_id(cls, payload: str) -> Optional[str] to inspect base64url payloads and return the colon-separated hex key fingerprint without requiring secret decryption.
Explicit Payload Length Guards:
Enforced strict minimum length guards ($\ge 28$ bytes for legacy, $\ge 40$ bytes for versioned) to fail fast on truncated inputs before touching underlying cryptographic routines.

Related Issues

Closes #1770

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update

How Has This Been Tested?

Automated backend unit and integration test suites executed:

.\venv\Scripts\pytest testing/backend/unit/test_vault.py testing/backend/unit/test_vault_failure_messages.py testing/backend/unit/test_vault_fingerprint.py testing/backend/unit/test_vault_owner_isolation.py testing/backend/unit/test_vault_security.py -v

note :- though i have used ai to solve but i completely reviewed the changes made by ai tested it and then approved the changes

…tksh1#1547) * Resolves issue-utksh1#1413 * test: remove trailing whitespace

…1546) Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

…h1#1542) Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

…ksh1#1527) * Resolves issue-utksh1#1427 * Removes white spaces.

…odule (utksh1#1524) The extract_target helper in executor.py is a pure function but lives in a heavy import chain (FastAPI, cache, config). Per the maintainer's approved extraction pattern (used for routes_json_helpers), this extracts extract_target into a small import-safe executor_target_helpers module and re-exports it from executor.py so existing call sites keep working. Closes utksh1#1389. Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

…(mobile view) (utksh1#1513)

…1#1514)

…ows (utksh1#1515)

…#1516)

…1520) * Resolves issue-utksh1#1425 * Removed white spaces.

Co-authored-by: Tomeshwari-02 <tomeshwari903@gmail.com>

…ile, and workflow endpoints (utksh1#1557)

…h1#1563) Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

utksh1

The vault key-version work should be reviewed independently. Please remove the unrelated saved-views auth-test edits, retain only vault implementation/tests, and rebase before re-review.

Cover the scapy_recon plugin parser.py with targeted behavioural tests: - Metadata contract: file existence, valid JSON, required fields, engine binary, target/type field declarations - ARP output: host count, IP+MAC extraction, finding keys, category, severity, description content, metadata consistency, remediation - ICMP output: host count, IP extraction, Unknown-MAC default - Single-host edge case: IP+MAC in result and description - Malformed/empty input: empty string, whitespace-only, no UP: lines, mixed noise lines, malformed UP: lines, missing MAC separator No changes to backend source; test file only.

…sh1#1770)

…vault.py

…ocking CI

trivikramkalagi91-commits · 2026-07-26T16:46:03Z

hi @utksh1 to solve the failing test i have raised one more PR (#2244 )once tht PR is merged this PR will be ready to merge

* fix: stop dashboard polling after health failure and add manual retry * fix: skip pre-existing upstream auth tests that cannot pass with mocked auth * fix: update postcss to resolve GHSA-r28c-9q8g-f849 high severity vulnerability * fix: document localhost-only Docker binding, add opt-in network override

trivikramkalagi91-commits · 2026-07-30T10:20:38Z

hey @utksh1 once please review the PR as all 26 checks are passsed and the issue is solved

…ksh1#2390)

* Fix risk scoring defaults * Update risk scoring tests

…low runs (utksh1#2396) POST /workflows/{id}/run and WorkflowScheduler._run_workflow now apply the same exploit-validation gate as start_task: exploit-level plugins and validation_mode=CONTROLLED_EXTRACT steps require a target policy with allow_exploit_validation=True, otherwise the step is skipped with a warning. Fixes utksh1#2395

…h1#2367) Closes utksh1#1845 Escape was a no-op outside text fields. useShortcuts had: if (e.key === 'Escape') { // Could emit global event to close modals return } so nothing was ever emitted and no popover had anything to listen for. useShortcuts now broadcasts a CustomEvent, and useEscapeToClose is the subscriber side. Keeping the single window-level keydown listener in useShortcuts and fanning out via one event means the listener count does not grow with the number of overlays on a page, and every overlay closes the same way. Wired into both affected surfaces. The Saved Views panel is the one named in the issue; the bulk-export dropdown on the Findings page had the same problem and is fixed with it. useEscapeToClose only subscribes while its overlay is open, so a closed popover neither reacts nor keeps a listener alive. Escape while typing keeps its existing behaviour: useShortcuts blurs the focused field and returns without broadcasting. A field inside a panel therefore takes two presses — one to leave the field, one to close the panel — so a stray Escape mid-typing cannot discard what was being entered. That is pinned by a test rather than left implicit. Verified by mutation: dropping the broadcast fails the useShortcuts test, and dropping the subscriber fails the SavedViewsPanel test.

* Add retry support for notification delivery * Remove trailing whitespace

Co-authored-by: Soujanya S H <hsoujanya2k4@gmail.com>

* test: add unit tests for _validate_lengths field length guard Covers valid/boundary/over-limit cases for name, description, and notes fields, plus custom resource_type substitution and None handling for optional fields. Closes utksh1#2307. * fix: bump undici to patch high-severity vulnerability (GHSA-8xcm-r25x-g524 and related)

* fix(theme): persist dark mode in localStorage and sync html class * fix(deps): override undici to resolve npm audit vulnerability * fix(deps): bump undici override to ^8.10.0 to resolve high severity audit vulnerability * fix(deps): update jsdom to v25 and override undici for CI compatibility

…#2446) (utksh1#2451) * test: add tests for rate_limiter.check_scan_rate_limit (closes utksh1#2446) * test: fix sys.modules pollution in rate_limiter check_scan_rate_limit tests (closes utksh1#2446) --------- Co-authored-by: Mavis Bot <mavis-bot@mini.max>

Rakshak05 and others added 30 commits July 1, 2026 21:58

test: add SavedViewsPanel rename and delete flow tests utksh1#1413 (u…

0460424

…tksh1#1547) * Resolves issue-utksh1#1413 * test: remove trailing whitespace

test : added ErrorBoundary fallback and reset behavior tests (utksh1#…

7c4d8bf

…1546) Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test : add toolCheatSheets content schema coverage (utksh1#1544)

fa07f0a

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

fix: replace silent path safety exception with debug log (utksh1#1543)

90ab101

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

fix: replace silent process group poll exception with debug log (utks…

7026162

…h1#1542) Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test : add parser unit tests for ssh_runner plugin (utksh1#1541)

f250fc0

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test : add parser unit tests for sqlmap plugin (utksh1#1540)

78f6727

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test : add parser unit tests for sqli_checker plugin (utksh1#1539)

44c8e65

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test : add parser unit tests for secret_scanner plugin (utksh1#1538)

6ce0fcb

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test : add parser unit tests for scapy_recon plugin (utksh1#1537)

6e58a6d

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

Resolves issue-utksh1#1430 (utksh1#1530)

0f0fa8a

Resolves issue-utksh1#1428 (utksh1#1528)

9af5fbf

tests(metasploit): add parser and metadata unit tests utksh1#1427 (ut…

8441e05

…ksh1#1527) * Resolves issue-utksh1#1427 * Removes white spaces.

Resolves issue-utksh1#1426 (utksh1#1526)

a522725

Resolves issue-utksh1#1429 (utksh1#1529)

93d2b89

ci: ignore local virtualenv directories (utksh1#1510)

8ec56fc

Resolves issue-utksh1#1423 (utksh1#1511)

db9aa8c

Fix utksh1#1170: Bottom section UI overlap/misalignment on Dashboard …

5681e24

…(mobile view) (utksh1#1513)

Fix utksh1#1488: Missing Rate Limiters on Management Endpoints (utksh…

1606c2c

…1#1514)

Fix utksh1#1491: Unhandled Type Conversion and Logic Errors in Workfl…

00e5bd2

…ows (utksh1#1515)

Fix utksh1#1490: Missing Validation for JSON Payload Contents (utksh1…

8b35203

…#1516)

[PLUGINS] Add parser unit tests for httpx plugin utksh1#1425 (utksh1#…

060d620

…1520) * Resolves issue-utksh1#1425 * Removed white spaces.

docs: update browser auth session flow (utksh1#1555)

9edf153

Co-authored-by: Tomeshwari-02 <tomeshwari903@gmail.com>

test(secret_scanner): add parser fallback coverage (utksh1#1556)

846d190

feat(validation): introduce string length constraints on policy, prof…

604e4e5

…ile, and workflow endpoints (utksh1#1557)

test: add unit tests for executor_target_helpers.extract_target (utks…

5cb0dd4

…h1#1563) Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test: add unit tests for wpscan plugin parser helpers (utksh1#1564)

09c55a7

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test: add unit tests for hashcat plugin parser (utksh1#1565)

d95c69a

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

test: add unit tests for port-scanner plugin parser (utksh1#1566)

1369bac

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>

utksh1 requested changes Jul 24, 2026

View reviewed changes

Khanvilkarshravani27 and others added 3 commits July 24, 2026 15:10

feat(vault): add key-version header and rotation keyring support (utk…

7f1544e

…sh1#1770)

style(tests): fix trailing EOF whitespace formatting hygiene in test_…

5170d55

…vault.py

trivikramkalagi91-commits force-pushed the fix/layout-overlap-906-refactor-v2 branch from 9d9b84d to 5170d55 Compare July 26, 2026 15:50

trivikramkalagi91-commits mentioned this pull request Jul 26, 2026

fix(tests): fix saved views auth rejection tests in test_saved_views.py #2244

Closed

8 tasks

chore(deps): update postcss to resolve high-severity vulnerability bl…

71189c9

…ocking CI

shravanithouta108 and others added 2 commits July 30, 2026 11:50

Merge branch 'main' into fix/layout-overlap-906-refactor-v2

25335c4

AnzalKhan16 and others added 12 commits August 4, 2026 15:22

ci: Add Dependabot configuration for automated dependency updates (ut…

6086a79

…ksh1#2390)

Fix risk scoring defaults (utksh1#2393)

d5cf856

* Fix risk scoring defaults * Update risk scoring tests

ci: Pin GitHub Actions to immutable commit SHAs (utksh1#2402)

5dabf25

Limit webhook response buffering (utksh1#2416)

d508c40

Add retry support for notification delivery (utksh1#2360)

7239e61

* Add retry support for notification delivery * Remove trailing whitespace

docs: document raw scan output retention and cleanup (utksh1#2351)

837bdce

Co-authored-by: Soujanya S H <hsoujanya2k4@gmail.com>

Merge branch 'main' into fix/layout-overlap-906-refactor-v2

c07dec6

utksh1 closed this Aug 15, 2026

utksh1 force-pushed the main branch from 933bf67 to 45aac5c Compare August 15, 2026 18:38

Navigation Menu

feat(vault): add key-version header and rotation keyring support (#1770) - #2051

feat(vault): add key-version header and rotation keyring support (#1770)#2051
trivikramkalagi91-commits wants to merge 956 commits into
utksh1:mainfrom
trivikramkalagi91-commits:fix/layout-overlap-906-refactor-v2

trivikramkalagi91-commits commented Jul 21, 2026 •

edited

Loading

Uh oh!

utksh1 left a comment

Uh oh!

trivikramkalagi91-commits commented Jul 26, 2026

Uh oh!

trivikramkalagi91-commits commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

trivikramkalagi91-commits commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Technical Enhancements

Related Issues

Type of Change

How Has This Been Tested?

Uh oh!

utksh1 left a comment

Choose a reason for hiding this comment

Uh oh!

trivikramkalagi91-commits commented Jul 26, 2026

Uh oh!

trivikramkalagi91-commits commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

trivikramkalagi91-commits commented Jul 21, 2026 •

edited

Loading