PrimeVault

An encrypted project organizer and secrets vault for PRIME's dev team, built on real envelope encryption: an Argon2id-derived key-encryption key wraps a per-user data-encryption key under AES-256-GCM, with failed-attempt lockout and dual recovery paths (PIN reset and a recovery-passphrase-wrapped DEK copy) — nothing is readable from a raw database dump. Per-project workspaces hold metadata, contacts, and operational links; credentials move through a needed-to-received lifecycle with encrypted values; secure notes hold .env blobs; shared team vaults carry roles and link grants alongside a personal vault and a full activity log. A companion Claude Code plugin ships 5 slash commands to push and pull a project's .env files and AI memories from any directory.

• Envelope encryption (Argon2id KEK + AES-256-GCM DEK) — nothing readable from a raw DB dump
• Dual recovery paths: PIN reset and a recovery-passphrase-wrapped DEK copy
• Credential lifecycle tracks needed → received with encrypted values throughout
• Companion Claude Code plugin ships 5 slash commands for pushing/pulling .env files and AI memories
• Shared team vaults with roles and link grants, alongside a personal vault and full activity log

• Next.js 16
• React 19
• TypeScript
• Prisma
• Supabase
• Argon2id
• AES-256-GCM
• Claude API
• Resend
• Tailwind v4
• Vitest

This is a proprietary platform for PRIME · Internal Tooling. The live application is not publicly accessible and can't be shared — the stack, scope, and (where shown) screens above reflect the real system.