External review guide

Prepared October 11, 2026; published baselines updated for 0.3.2 on October 18, 2026. This handoff defines the source, threat model, review surface and evidence gaps. It does not claim a completed human security audit. Review the vault construction together with the resolved Keypass dependency.

Source and published baseline

The 0.3.2 publication record gives its source, CI, signed tags and artifact hashes, and how the Keypass archive was verified against its source. The 0.3.0 tags are unsigned; see verifying releases. The SDK 0.2.0 and CLI 0.2.0 publication records keep that release’s installation evidence. Versions 0.3.1 and 0.3.2 change documentation, pub.dev metadata, the TUI failure view and the Keypass build dependency, not the vault construction. Version 0.3.0 removed retired V2 singleton-passphrase reading/migration and duplicate release tooling, and writes methods policy 3, which adds a credential confirmation; 0.2.0 policy-2 and old singleton packages fail without mutation. The platform-only encoding is unchanged. There is no automatic conversion. Version fields alone do not identify a checkout’s contents.

Capture git rev-parse HEAD, git status --short, toolchain versions, pubspec.lock, native library versions/hashes and the precise tested artifact. dart pub get --enforce-lockfile preserves this repository’s hosted resolution. A consumer has its own lockfile. Checking out new Keypass main does not change Keybay’s dependency; any local override is a separate joint-test configuration and must not be represented as the published integration.

Read in this order

1. Security policy and design: threat model, platform identity, storage invariants and exclusions.
2. SDK guide and CLI guide: actual API behavior, disclosure paths, native setup and recovery.
3. RFC 0003: method selection, derivation, HPKE, authenticated directory, transaction and key-rotation rules. It supersedes authentication sections of the original V2 RFC.
4. Keypass review guide: verifier, provider/CTAP trust, PRF association and native result ownership.
5. Qualification, CLI qualification, device suite and release scope.
6. Prior security reviews and watcher assessments.

Dated reviews and RFC milestone notes retain their original scope. The September reviews predate the completed passkey integration and do not audit its HPKE or native passkey boundary. doc/reviews/ contains plans as well as receipts; read status/date/source before treating a document as current behavior. Local ignored build/qualification/ receipts mentioned in publication records are not all in a fresh clone; obtain the named redacted artifacts from the maintainer when required. Missing evidence must remain a gap in the report.

Boundaries to review

Test filenames above are under packages/keybay/test/ unless otherwise noted.

Prioritize whether an untrusted package/record can redirect platform identity, select a different method, bypass the manifest, release a provisional key or commit stale authentication metadata. Check HPKE context binding and low-order inputs; rotation must trust only already-authenticated survivor public keys. Verify cancellation, native result disposal and crash/concurrent-writer behavior at every transition. Review bounds before Argon2, allocation or native ceremony.

The policy is platform AND (passphrase OR passkey A OR ...), with at most one passphrase and eight total methods. An authenticated session may change policy. Removing the last method returns to platform-only protection. There is no atomic passphrase replacement; remove/add are separate commits. Old complete snapshots remain usable with their old credentials/platform material. Direct hardware RP namespaces and ordinary desktop application IDs do not authenticate executables. These are explicit design limits, not gaps to conceal in a support claim.

Outstanding work at handoff

The latest retained assessed watcher run is October 12. It found no new established Keybay defect and retained #75/#76. A successful scan job is not a zero-findings or full-reachability guarantee. Recheck current advisories and open issues when beginning the audit.

Reproduce and deliver findings

With the documented native build prerequisites:

dart pub get --enforce-lockfile
dart analyze --fatal-infos
./tool/test_core.sh
(cd packages/keybay_cli && dart test -x integration)

These are core checks, not physical qualification. Platform regression describes Linux/macOS/native CI and separate attended device procedures. Review both independent crypto references under packages/keybay/test/vectors/ and tool/v2_suite1_reference_go/; do not overwrite checked-in vectors as a substitute for comparison. Reviewers should use disposable stores and keys. Do not run reset, PIN administration or provider deletion against personal data.

Return a dated report with exact source/dependencies/artifacts, reviewed and excluded surfaces, repeatable findings with severity/impact, platform-specific observations and unresolved assumptions. Report undisclosed vulnerabilities via private reporting, without secrets or personal vault material. Record remediation and retest against a new exact commit. Completion of review is separate from publication and supported-platform qualification.