01 — Overview
SecureVault is a self-hosted credential and secrets manager for teams that do not want vault data on a third-party SaaS. Administrators manage encrypted entries, users, and security policy from a web console with full Arabic RTL and English localization.
02 — My contribution
I designed and implemented the application end to end: Next.js admin UI, Prisma data layer, encryption and decryption paths, RBAC enforcement, session handling with revocation, password policy configuration, and the append-only audit trail enforced at the database.
03 — Technical architecture
Next.js 16 App Router with React 19 and TypeScript on the front; PostgreSQL 16 with Prisma 7 for persistence. Secrets are encrypted with AES-256-GCM using a master key that never enters the database — each record carries its own IV and auth tag. Roles (`SUPER_ADMIN`, `EDITOR`, `VIEWER`) gate mutations and reveals. PostgreSQL triggers append tamper-evident audit rows for sign-ins, reveals, and policy changes. Docker Compose is provided for a reproducible self-hosted deploy.
04 — Engineering challenges
- Encrypting at rest without leaking key material: all crypto runs server-side with a single master key from environment configuration, while the UI only ever sees decrypted values in ephemeral reveal flows.
- Immutable auditing: application code alone cannot delete history — triggers on the audit table reject updates and deletes so compliance-oriented deployments get a credible append-only log.
- Bilingual admin UX: security screens, tables, and forms had to work in RTL and LTR without duplicating routes, which shaped component layout and copy structure from the start.
05 — Testing and quality
Exercised credential CRUD, reveal-and-copy flows, lockout policy, and role boundaries manually across both locales. Docker-based smoke runs verify migrations and seed paths. Automated test coverage is still thin relative to the crypto and trigger surface — the highest-value next tests would lock the encryption contract and audit trigger behavior.
06 — Results and lessons
Open-source on GitHub with documentation and screenshots for dashboard, vault, security policy, RBAC, and audit views. The project demonstrates full-stack security-minded delivery, not only UI work. A public hosted demo is not shipped; evaluators are expected to run Docker locally or review the repository.