Changelog

User-visible changes only. Internal refactors and test work don’t appear here.

Because there are no public builds yet, this starts as a record of what exists rather than a list of releases. It becomes a normal changelog with the first early-access build.

0.1.0 — unreleased

The first complete version: desktop app, CLI, and the zero-knowledge server.

Vault

Projects and environments, with drag-to-reorder tabs shared across the team
Three entry types — secret, url, env — with env rendering unmasked
Masked-by-default values, per-row reveal, notes treated as secret material
Copy to clipboard with a ~20-second auto-clear, surfaced in the toast
Multi-line and file values; paste a whole .env into the add drawer
Payload version history
Personal-scope overrides: override single keys per developer, encrypted so only the owner can read them; grouped rows with a personal — overrides shared badge and a scope-aware add/edit drawer

Locking

Lock on 15 minutes idle, on every platform
Lock on sleep, display sleep, and screen lock — macOS only for now
Key material zeroized on lock; revealed values collapse

Teams

Invite by email with a single-use token, 7-day expiry, revocable
Two-step handshake: accept and publish a key, then admin confirmation
Mandatory out-of-band fingerprint ceremony before any key is wrapped
Per-environment grants: no access, read, or write. New members default to no access
Atomic revoke-and-rotate with key epochs
Roster, role changes, and member removal

Sync

Optimistic concurrency with a client-side 3-way merge
Per-key conflict prompts; never a silent last-writer-wins
Durable version high-water mark, so a replayed older payload is refused
A per-member personal overlay with its own version counter; conflicts park per scope; a presence watermark makes a server that hides your overlay a hard failure, not a silent fallback to shared values

Recovery

Personal recovery with the Recovery Key — key pair unchanged, grants and personal overrides intact
Admin-assisted recovery with a new key pair, for shared environments — personal overrides are destroyed by construction
Recovery email delivery fixed in production, with a boot-time guard so a misconfigured mailer can no longer fail silently

Audit

39 recorded action types, including every read of an environment’s payload
Admin- and owner-gated, per project; personal-override writes are account-scoped, and personal reads are unaudited by design

CLI

cendarum run — inject the effective environment (ambient < shared < personal) into a child process; nothing written to disk, and a value-free warning names personal overrides that shadow shared values
cendarum import — .env to encrypted payload, with duplicate keys refused; --scope shared|personal is required
cendarum export — the friction’d escape hatch, with a git-working-tree guard; --scope shared|personal|effective is required
Exit-code passthrough and signal forwarding

Server

Rate limiting keyed on the real client IP behind the production proxy, measured rather than inferred

Known gaps in this version

No signed or notarised installers
Sleep and screen-lock auto-locking on Windows and Linux
No offline reading of secrets
No CI or headless support
The per-framework compatibility matrix has not been run end to end
Link sharing is specified but not implemented

See the roadmap for what happens to these.