SEAL STATUS
Unsealed (Auto KMS)
Backend: AWS S3 + KMS
VAULT AUTH METHOD
AppRole Auto-Renew
Zero Root Token Used
TRANSIT CRYPTOGRAPHY
AES-256-GCM96
Key: customer-card
DYNAMIC CONFIG VERSION
v1 (Live)
Hot-reloaded from KV-v2
Proof 1: Zero-Secret Configuration Explorer
Application boots with zero credentials in .env. All secrets are pulled dynamically from Vault's KV-v2 engine.
stripe_key
Dynamic
Loading...
database_url
Dynamic
Loading...
jwt_secret
Dynamic
Loading...
Vault Path:
secret/data/vaultguard/config
Last Synchronized: --
Proof 2 & 3: Transit Encryption-as-a-Service Simulator
When you submit sensitive credit card data, the server calls Vault Transit's POST /v1/transit/encrypt/customer-card.
The application discards plaintext immediately and stores only the ciphertext in the local SQLite database.
Transit Encryption Pipeline
AES-256-GCM
1
Plaintext Card Input (Client Browser)
4532 8901 2345 6789
2
Vault Transit Ciphertext (https://vault.phearum.xyz)
vault:v1:qK87f89dskjfa892gH79sK... (Generated by Vault)
3
Persisted to SQLite (data/portal.db)
INSERT INTO customers VALUES (..., 'vault:v1:qK87f...', '6789')
Zero key material exists on the web server; keys are locked in Vault memory.
Proof 4: Database Storage Inspection & Authorized Decryption
Inspect the raw SQLite database records on disk vs authorized on-the-fly decryption via Vault.
| ID | Customer | Card Data (Stored in SQLite) | Last 4 | Created | |
|---|---|---|---|---|---|
| Loading stored records... | |||||