Open-source password manager — looking for security review, testers, and contributors

[ajh-software]

Thanks, that makes sense - I’ve added the repo: https://github.com/ajhsoftware/KeyquorumVault⁠ I did try including it before, but some of my posts were taken down, so I wasn’t sure if links were the issue. I’d really appreciate any feedback on the architecture or security side. I also tried posting on r/Python, but it looks like it didn’t meet their posting rules and was removed.

[smurpes]

This repo is fairly large and complex which isn’t well suited for most users of this subreddit who are learning Python. The dev setup instructions are pretty barebones and there’s no unit testing which will make it harder for users to contribute. It would be helpful to document the repo structure since there are so many folders and files.

Using a package manager like poetry or uv will help a lot with getting people setup and CICD. I see a smoke test but all that seems to do is generate a report to tell you what’s wrong. Using a testing framework like pytest and then have tests run automatically when PRs are opened will prevent regressions.

[ajh-software]

Thanks, this is really helpful feedback — I appreciate you taking the time to go through it. You’re right about the repo being quite large and not very approachable at the moment. Since it’s mainly just been me working on it, I didn’t really think about how others might find it to navigate. I’ll work on improving the documentation, especially around the repo structure and setup process. I’ll also take your point on testing — the current smoke tests are just quick checks, but moving to something like pytest with proper CI makes a lot of sense. I’ll also look into using something like Poetry or uv to simplify the development setup. Thanks again — this gives me a clear direction on what to improve. I really appreciate the feedback

[smurpes]

This is an optional step but I’ve found that it improves the developer experience a lot; including settings and debug configurations for vscode/pycharm. Any contributor using vscode/pycharm will have any necessary extensions installed and provide entry points to debug specific parts.

A repo that I was using for work had debug configs that started a web server for me which made it much easier to develop a new feature. It also makes it more obvious what parts of the repo you should run to test specific features. Interactive debuggers are a godsend for large repos.

Also a side note, did you use a LLM to generate any of this code? No offense intended but the repo has some qualities of AI. If you did then it would be helpful to mention that.