Reported issues for envault

Pod holds 7 of 7 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to envault.

Most discussed

[Security] Implement Strict Input Validation & Query Parameterization

Description

To harden the application against SQL injection and Logic Injection attacks, we need to enforce strict schema validation at the application edge. Since we are operating on a free tier, we must reject malformed requests before they touch the database to save resources.

Currently, input validation is partial or relies implicitly on the frontend. There is a risk of "raw" queries or mass assignment vulnerabilities where a user might attempt to inject malicious payloads.

Prop

Read the thread · 2026-02-18 · closed · 1 comment

Docs/DX: Clarify Agent Interceptor Auditability and MIT-Licensed Boundaries

Description: The Problem: Developers are hesitating to integrate the MCP server due to "Black Box" fears. They are skeptical of proprietary binaries holding mutation privileges over their local files via AI agents.

The Reality: Our core vault is proprietary, but the execution boundary is completely transparent. We need to expose this reality without writing defensive security-first copy. It needs to be framed as ultimate developer control.

Tasks:

Update the Agent/MCP market

Read the thread · 2026-05-04 · closed · 0 comments

[ENHANCEMENT]: Mitigate HITL Approval Fatigue: Frictionless Reads & Visual Secret Diffs

The Problem

Developers are experiencing alert fatigue due to the Human-In-The-Loop (HITL) approval requirements. If the AI agent requires manual approval for every context-gathering action, users build muscle memory to blindly execute envault approve. This nullifies our security model.

The Solution

We must categorize agent actions. Read operations must be frictionless and automatic. Write/Modify operations must force the developer to visually inspect a diff of the specific secret keys

Read the thread · 2026-05-03 · closed · 0 comments

[DOCS]: Add "Exit Plan" / Vendor Lock-in Mitigation Guide

Description: Currently, potential users have no guarantee that they can recover their production secrets if Envault shuts down, the maintainer abandons the project, or the hosted servers go offline. This "bus factor" is a major blocker for adoption.

We need a dedicated "Exit Plan" documentation page that explicitly details how teams can export 100% of their decrypted secrets in under 5 minutes and permanently sever ties with the platform.

Acceptance Criteria:

Create a new MDX page in

Read the thread · 2026-05-02 · closed · 0 comments

Epic: Official AI Agent Skills for Envault

Problem: AI coding agents (Cursor, Cline, Windsurf) default to insecure secret management. They attempt to write .env files to disk, bypass our Git tracked-file blocks, and get stuck in infinite retry loops when our MCP server returns a 202 Accepted for HITL approvals.

Solution: Create a standardized AI agent skill following the .agents/skills/ convention. This will teach LLMs how to natively interact with the Envault CLI and MCP server, allowing users to install the skill via the

Read the thread · 2026-04-25 · closed · 0 comments

Epic: Official MCP Registry Listing & Token Friction Mitigation

The Reality

We want to list Envault on the official Model Context Protocol (MCP) Registry. However, the registry is a static phonebook, not an app store. It offers zero onboarding help and zero security shielding.

Because our architecture requires users to inject a short-lived envault_agt_ delegated JWT and base URL into their local client configs (Claude/Cursor), the drop-off risk is massive. If developers cannot figure out how to generate this token within 30 seconds, they will abandon

Read the thread · 2026-04-21 · closed · 0 comments

[BUG]: Link Copying Inconsistency on Android and Google Site Indexing/SEO Failures

Describe the Bug

There are two primary issues affecting the sharing and discoverability of Envault links:

Inconsistent Native Sharing (Link Truncation): When sharing a specific link like envault.tech/docs using Safari on iOS, the link copies correctly with its full path. However, when attempting to natively share the same link on an Android device, the copied link truncates the path and simply resolves to the root domain envault.tech.
SEO & Page Crawl Failures: Google Site

Read the thread · 2026-03-01 · closed · 0 comments

Most recent

The remaining reports are on the project's issue tracker.