[{"data":1,"prerenderedAt":422},["ShallowReactive",2],{"navigation":3,"\u002Fguides\u002Fsecurity":116,"\u002Fguides\u002Fsecurity-surround":417},[4,27,61,82,112],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":26},"Getting started","i-lucide-rocket","\u002Fgetting-started","1.getting-started",[10,14,18,22],{"title":11,"path":12,"stem":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction",{"title":15,"path":16,"stem":17},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation",{"title":19,"path":20,"stem":21},"Quick start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start",{"title":23,"path":24,"stem":25},"Development","\u002Fgetting-started\u002Fdevelopment","1.getting-started\u002F4.development",false,{"title":28,"icon":29,"path":30,"stem":31,"children":32,"page":26},"Guides","i-lucide-book-open","\u002Fguides","2.guides",[33,37,41,45,49,53,57],{"title":34,"path":35,"stem":36},"Sessions and store","\u002Fguides\u002Fsessions","2.guides\u002F1.sessions",{"title":38,"path":39,"stem":40},"Vault and procedures","\u002Fguides\u002Fvault","2.guides\u002F2.vault",{"title":42,"path":43,"stem":44},"Password accounts","\u002Fguides\u002Fpasswords","2.guides\u002F3.passwords",{"title":46,"path":47,"stem":48},"Rust backend","\u002Fguides\u002Frust","2.guides\u002F4.rust",{"title":50,"path":51,"stem":52},"Security notes","\u002Fguides\u002Fsecurity","2.guides\u002F5.security",{"title":54,"path":55,"stem":56},"Permissions","\u002Fguides\u002Fpermissions","2.guides\u002F6.permissions",{"title":58,"path":59,"stem":60},"Coming from Stronghold","\u002Fguides\u002Fstronghold","2.guides\u002F7.stronghold",{"title":62,"icon":63,"path":64,"stem":65,"children":66,"page":26},"API reference","i-lucide-file-code","\u002Freference","3.reference",[67,71,75,79],{"title":68,"path":69,"stem":70},"JavaScript API","\u002Freference\u002Fjavascript-api","3.reference\u002F1.javascript-api",{"title":72,"path":73,"stem":74},"Types","\u002Freference\u002Ftypes","3.reference\u002F2.types",{"title":76,"path":77,"stem":78},"Tauri commands","\u002Freference\u002Fcommands","3.reference\u002F3.commands",{"title":54,"path":80,"stem":81},"\u002Freference\u002Fpermissions","3.reference\u002F4.permissions",{"title":83,"icon":84,"path":85,"stem":86,"children":87,"page":26},"Platforms","i-lucide-monitor-smartphone","\u002Fplatforms","4.platforms",[88,92,96,100,104,108],{"title":89,"path":90,"stem":91},"Overview","\u002Fplatforms\u002Foverview","4.platforms\u002F1.overview",{"title":93,"path":94,"stem":95},"macOS","\u002Fplatforms\u002Fmacos","4.platforms\u002F2.macos",{"title":97,"path":98,"stem":99},"Windows","\u002Fplatforms\u002Fwindows","4.platforms\u002F3.windows",{"title":101,"path":102,"stem":103},"Linux","\u002Fplatforms\u002Flinux","4.platforms\u002F4.linux",{"title":105,"path":106,"stem":107},"Android","\u002Fplatforms\u002Fandroid","4.platforms\u002F5.android",{"title":109,"path":110,"stem":111},"iOS","\u002Fplatforms\u002Fios","4.platforms\u002F6.ios",{"title":113,"path":114,"stem":115},"Changelog","\u002Fchangelog","9.changelog",{"id":117,"title":50,"body":118,"description":410,"extension":411,"generated":26,"links":412,"meta":413,"navigation":414,"path":51,"seo":415,"stem":52,"__hash__":416},"docs\u002F2.guides\u002F5.security.md",{"type":119,"value":120,"toc":398},"minimark",[121,138,143,176,179,183,283,286,304,312,324,328,357,361,377,381],[122,123,124,125,129,130,133,134,137],"p",{},"The plugin moves secrets between three places: the ",[126,127,128],"strong",{},"OS credential store",", the ",[126,131,132],{},"Rust process"," and\nthe ",[126,135,136],{},"webview",". Know which data reaches which place.",[139,140,142],"h2",{"id":141},"what-protects-the-data","What protects the data",[144,145,146,157,165],"ul",{},[147,148,149,152,153,156],"li",{},[126,150,151],{},"The OS store."," Entries are encrypted and access-controlled by the platform: Keychain, Credential\nManager, Secret Service, the Android keystore, the iOS data-protection keychain. Anyone who can act as\nyour user on the machine (or as your app on mobile) can usually read them. See ",[154,155,83],"a",{"href":90},".",[147,158,159,162,163,156],{},[126,160,161],{},"Tauri permissions."," Only windows whose capability includes the plugin can call it. See\n",[154,164,54],{"href":55},[147,166,167,170,171,175],{},[126,168,169],{},"Not the session password."," ",[172,173,174],"code",{},"KeyringSession.load(path, password)"," does not verify or use the\npassword: any password opens any session. It exists only for Stronghold compatibility. There is no\nsnapshot file encrypted with it.",[122,177,178],{},"There is no in-memory or file fallback: if the OS store does not work, calls fail instead of writing\nsecrets somewhere else.",[139,180,182],{"id":181},"what-reaches-the-webview","What reaches the webview",[184,185,186,199],"table",{},[187,188,189],"thead",{},[190,191,192,196],"tr",{},[193,194,195],"th",{},"Data",[193,197,198],{},"Webview sees it?",[200,201,202,219,230,242,253,264,275],"tbody",{},[190,203,204,216],{},[205,206,207,208,211,212,215],"td",{},"Password secrets (",[172,209,210],{},"getPasswords",", ",[172,213,214],{},"setPasswords",")",[205,217,218],{},"Yes: they are the API.",[190,220,221,227],{},[205,222,223,224,215],{},"Store records (",[172,225,226],{},"store.get",[205,228,229],{},"Yes.",[190,231,232,235],{},[205,233,234],{},"Vault records",[205,236,237,238,241],{},"Written from JS with ",[172,239,240],{},"vault.insert",", never read back.",[190,243,244,247],{},[205,245,246],{},"Private keys made by procedures",[205,248,249,252],{},[126,250,251],{},"No."," Procedures return only a chain code, a public key, a signature, or nothing.",[190,254,255,261],{},[205,256,257,258,215],{},"A new BIP39 mnemonic (",[172,259,260],{},"generateBIP39",[205,262,263],{},"Yes, once, so the user can back it up.",[190,265,266,272],{},[205,267,268,269,215],{},"Plain backup (",[172,270,271],{},"exportPasswordsPlain",[205,273,274],{},"Yes, in clear text.",[190,276,277,280],{},[205,278,279],{},"Encrypted backup",[205,281,282],{},"Only the envelope; the passphrase is sent to Rust.",[122,284,285],{},"Anything the webview holds can be read by any script running in it, so:",[144,287,288,291,298,301],{},[147,289,290],{},"Never load remote or untrusted content in a window that has the plugin's permissions.",[147,292,293,294,297],{},"Do not keep secrets in global state, ",[172,295,296],{},"localStorage",", logs or error reports longer than needed.",[147,299,300],{},"Show a new mnemonic once and drop the reference; never write it to disk or send it anywhere.",[147,302,303],{},"Prefer vault procedures over storing key bytes in the store: keys in the vault never leave Rust.",[139,305,307,308,311],{"id":306},"reserved-kp-accounts","Reserved ",[172,309,310],{},"kp:"," accounts",[122,313,314,315,317,318,320,321,323],{},"Store records and vault keys are entries whose account starts with ",[172,316,310],{},". The password commands reject\nsuch accounts in any letter case, so ",[172,319,210],{}," cannot read vault keys and ",[172,322,214],{}," cannot\noverwrite them. This guard is part of the IPC layer; Rust code can still reach every account.",[139,325,327],{"id":326},"what-the-plugin-does-with-secrets-in-rust","What the plugin does with secrets in Rust",[144,329,330,345,348,354],{},[147,331,332,333,336,337,340,341,344],{},"Passwords, passphrases, decrypted backups, seeds and derived keys are wiped from memory after use\n(",[172,334,335],{},"zeroize",", also inside ",[172,338,339],{},"argon2"," and ",[172,342,343],{},"chacha20poly1305",").",[147,346,347],{},"Error messages never contain secret values, key material or mnemonic words; an invalid mnemonic\nfails with a fixed message.",[147,349,350,353],{},[172,351,352],{},"Debug"," output of the IPC types redacts secrets, mnemonics and passphrases.",[147,355,356],{},"Keyring calls run on blocking threads, so an OS prompt does not stall other commands.",[139,358,360],{"id":359},"backups","Backups",[144,362,363,366,374],{},[147,364,365],{},"Plain backups expose every secret to the webview and to wherever you save the file. Use them only in\nflows the user started on purpose.",[147,367,368,369,373],{},"Encrypted backups use Argon2id + ChaCha20-Poly1305 (",[154,370,372],{"href":371},"\u002Fguides\u002Fpasswords#encrypted","details","). Their\nstrength is the strength of the passphrase: ask the user for a long one, and never store it next to\nthe backup.",[147,375,376],{},"An import validates the whole backup first, so a bad or tampered file changes nothing.",[139,378,380],{"id":379},"limits-of-the-design","Limits of the design",[144,382,383,390,393],{},[147,384,385,386,389],{},"The OS stores cannot list entries, so you cannot audit \"everything the app stored\" from the plugin.\nKeep an index if you need to clean up (e.g. on sign-out, call ",[172,387,388],{},"deletePasswords"," for every known account).",[147,391,392],{},"Uninstalling the app does not always remove its entries (desktop keychains keep them). Delete them\nyourself if that matters.",[147,394,395,396,156],{},"On Linux without a desktop session, a locked Secret Service collection can block a call for a very\nlong time, see ",[154,397,101],{"href":102},{"title":399,"searchDepth":400,"depth":401,"links":402},"",2,3,[403,404,405,407,408,409],{"id":141,"depth":400,"text":142},{"id":181,"depth":400,"text":182},{"id":306,"depth":400,"text":406},"Reserved kp: accounts",{"id":326,"depth":400,"text":327},{"id":359,"depth":400,"text":360},{"id":379,"depth":400,"text":380},"What protects the secrets, what the webview can reach, and how to handle passwords, mnemonics and backups.","md",null,{},true,{"title":50,"description":410},"ABnQJUq1TpaurbKc8x0DkJi2wKX2MAPvOdgCDnkps50",[418,420],{"title":46,"path":47,"stem":48,"description":419,"children":-1},"Use KeyringStore from your own commands, set the service name, plug in another keyring-core store, and read secrets from background tasks.",{"title":54,"path":55,"stem":56,"description":421,"children":-1},"Allow the plugin's commands in a capability, and give each window only what it needs.",1794215488500]