dsh-encrypt: DSH Credential Encryption Plugin
dsh-encrypt is a DSH credential encryption plugin maintained by yauntyour (MIT license, current version 0.1.0-rc.12), designed to convert local plaintext credential files in-place into password-protected ciphertext while preserving the original file paths. The plugin employs a dual-form single-file mechanism: without a password, it remains as plaintext YAML, and once encrypted, it is replaced with AES-256-GCM ciphertext, with the key derived via Argon2id and integrity verified using SHA3-256. Core features include: password digest computation on the browser side to protect privacy, an exponential backoff mechanism to prevent brute-force attacks on unlock failure, automatic redaction of credentials in HTTP responses, and strict security restrictions allowing only localhost loopback connections. The plugin supports passwordless tickets, hot reloading, atomic writes, and memory cleanup to ensure sensitive data does not persist in logs or...
Read More