Ox0400/dsh-vault
An encrypted credential vault for DSH: AES-256-GCM at rest, a scrypt master password, and tools for logins, SSH, API keys, OAuth tokens and TOTP — with secret-free search and a security health scan.
dsh-vault stores sensitive credentials — usernames, emails, phone numbers, passwords, TOTP secrets and developer credentials such as SSH connections, API keys, secrets and OAuth access/refresh tokens — encrypted at rest, and exposes them to the model through CRUD, search, password-generation and TOTP tools plus a Settings page. Every entry is encrypted with a 256-bit key derived via scrypt(master password, salt) and AES-256-GCM; the key never touches disk, is cached in-process after unlock, and is re-derived on restart. GCM auth tags plus a fixed-plaintext verification envelope make a wrong master password or modified ciphertext fail immediately, and vault_search returns summaries only (never passwords, keys, tokens or TOTP secrets) while full credentials are readable only via explicit vault_get by id. A broad tool set covers password history and rollback, a one-time recovery code (only its SHA-256 hash stored), rotation reporting, encrypted backups, CSV import, bulk tagging/deletion with dry-run, and a vault_health scan for weak/reused passwords, missing 2FA and insecure http:// sites.
Install
dsh plugin --profile web add dsh-vaultCopied verbatim from the README's install badge/section (npm package dsh-vault). The README also lists the project on awesome-dsh-plugin and awesome-deepseek-harness.
Compatibility
A DSH plugin (with a Settings UI page). Built entirely on Node's built-in node:crypto — AES-256-GCM authenticated encryption, scrypt key derivation and RFC 6238 TOTP — so it has zero external crypto dependencies.
Details
- Repo: Ox0400/dsh-vault
- Category: Development & Runtime
- Stars: 12
- Version: GitHub repo Ox0400/dsh-vault; npm package dsh-vault at 1.10.74 (registry check 2026-10-08; registry repository field resolves back to this repo). MIT license.
Alternatives
tancheng33/dsh-credentials-vault · bigclawd/dsh-security-guard · omdsh-dev/dsh-security-audit