Dotward v1.8: Audit secrets locally. No cloud. No leaks. Ever.

Hey PH! 👋 Builder here — happy to do a full technical breakdown. What Dotward actually is: A local-first encrypted secret manager for developers. Your `.env` files, API keys, and credentials never leave your machine unencrypted — ever. The stack - Electron + Flask — UI is served by a local Flask server (Python) running as a compiled binary inside the app. No Node.js backend, no Electron IPC for data — Flask handles all vault logic - AES-256-GCM encryption— every secret is encrypted at rest with a master password you set. The encryption key never touches disk - SQLite — local database, fully encrypted payload storage Core features: Project-based vault— organize secrets by project, set expiry dates, get notified before they expire - Lock/unlock flow — vault locks on app close, requires master password to re-open - Security dashboard — scans your vault for weak, expired, or at-risk credentials - Secret scanner — scans your codebase for accidentally committed secrets using Shannon entropy + 19 regex patterns for known credential formats (AWS keys, JWT tokens, Stripe keys, etc.) Pre-commit hook installer — one command wires the scanner into your git workflow so secrets never make it into a commit - CLI — `dotward scan`, `dotward scan --all`, `dotward install-hook` — works standalone, zero dependency on the running app Security model - Master key derived from password, never stored - All vault data encrypted before writing to SQLite - Local-only — no cloud sync, no telemetry, no accounts - Auto-lock on inactivity Auto-updates: - `electron-updater` with GitHub Releases as the update server - Downloads silently in background, prompts on completion - macOS: ZIP-based delta updates via `latest-mac.yml` - Windows: NSIS `oneClick` installer, force-kills all processes before replacing binaries to prevent file lock errors Why we built it Leaked `.env` files are one of the most common causes of security breaches for indie devs and small teams. Every existing solution either requires cloud storage or is too complex to set up. Dotward is local, simple, and actually catches secrets before they escape.