Vault-Local

A machine-locked secret management and code protection system for Node.js on Windows.

Overview

Vault-Local provides professional-grade security by tying sensitive data and executable code to specific hardware identifiers. It leverages a native C# module to derive a high-entropy 256-bit encryption key from the motherboard serial number, BIOS UUID, processor ID, and system disk signatures.

Features

• Machine-Locked Secrets: Encrypts key-value pairs in a local store that is only accessible on the originating hardware.
• Code Protection: Encrypts JavaScript source files into an encrypted format (.vlt) that cannot be read by unauthorized users.
• Project Mirroring: Recursively encrypts entire directories into a dist/ folder, maintaining your project structure while protecting source code.
• Modular Loaders: Intercepts require() calls to allow seamless loading of machine-locked sub-modules without ever exposing plain text on the disk.
• Remote Authorization: Allows authorized execution on different hardware (e.g., Pterodactyl panels).

Installation

Ensure you have PowerShell and the .NET Framework installed on your Windows machine.

git clone <repository-url>
cd vault-local
npm link

Usage

Secret Management

Store and retrieve sensitive environment variables:

node cli.js set API_KEY "0123456789abcdef"
node cli.js get API_KEY

Full Project Protection

Protect an entire project directory:

# Encrypts the "./src" directory into "./dist"
node cli.js protect ./src ./dist

The system will:

1. Mirror the original directory structure.
2. Encrypt all .js files to .vlt files.
3. Copy non-code assets (JSON, images, etc.) as-is.

Execution

Execute the entry point of your protected project:

# Vault-Local handles all internal module resolution automatically
node cli.js run ./dist/index.js.vlt

Remote Server Deployment

To deploy protected code specifically to a remote server's hardware:

1. Obtain the remote server's Hardware ID:

   node cli.js hwid

2. Encrypt the source code for that specific ID:

   node cli.js protect ./src ./dist <remote-hwid>

Security Disclosure

Vault-Local uses AES-256-GCM for all encryption and authentication. This ensures both confidentiality and integrity of the data. Source code is decrypted only in RAM using the Node.js vm module.

License

All rights reserved.