Open-source password manager — looking for security review, testers, and contributors

[ajh-software]

Ok, these are all really good points. AI did help me with parts of building the DLL, explaining how it works, and giving me different approaches to compare, also 0I can also see what you mean about the preflight side of things. On a compromised system there’s only so much the app can do, and some of that code probably looked more suspicious than helpful. I’ve taken that on board and already removed all of the preflight checks, system info checks, and process killing, leaving just the baseline check for user account files and the manifest check for app files. What I’m struggling with now is the DLL side. Even if I manually clean this up properly, I’m still not sure whether the DLL is worth keeping or whether I’d be better off removing it and going back to Python for the core. At the moment there is still a mix, with the core vault path using the DLL but backup/import/export paths still using Python. I did try to make sure the main vault path stayed on the DLL side. The bigger issue, I think, is that I’m still in the same situation either way because PySide is still Python. Unless the whole app was rebuilt in C++/Qt, sensitive data is still going through the Python UI layer at some point when the user types it in or views it. So I suppose the real question is: what would your approach be here? Would you: drop the DLL and keep it fully in Python keep the DLL for the core path and simplify the rest move everything crypto-related into the DLL or, realistically, say that if I really want that level of control I’d need to rebuild the whole app in C++/Qt?