HN Showcase
Back to browse
GitHub Repository

Secure encrypted config store for Node.js (HKDF, key rotation, lockfile concurrency, atomic writes).

1 starsTypeScript

Crypthold – Deterministic, Tamper-Evident Secure State Engine

by laphilosophia·Feb 14, 2026·1 point·0 comments
Visit ProjectView on HN

AI Analysis

●●SolidWizardryBig Brain

Integrity-first config substrate with hash-linked history and cryptographic replay verification.

Strengths
  • •Deterministic state replay with hash verification ensures no silent corruption during recovery
  • •Atomic writes with cross-process locking prevent data loss from concurrent access or crashes
  • •Native key rotation without data loss plus fsync durability for high-stakes deployments
Weaknesses
  • •Niche problem space—most Node.js apps use dotenv or Vault, not specialized state engines
  • •Minimal traction: 0 stars, 1 PR, unclear production adoption or real-world case studies
Target Audience

Backend developers building security-sensitive applications

Similar To

HashiCorp Vault · etcd · CONFD

Post Description

Most encrypted config stores protect secrecy. Crypthold focuses on integrity, determinism, and lossless state guarantees.

v2.2.1 is a stability milestone. The core now enforces:

- Tamper-evident, hash-linked state history - Deterministic state + replay (same input → same state hash) - Crash-safe atomic persistence (no partial state) - Concurrency protection (no silent overwrite) - Strong integrity fail-closed model - Key lifecycle + rotation without data loss

Crypthold is not a secret manager and not a database. It is a verifiable state substrate for security-sensitive software.

If a single bit changes, integrity breaks. If history changes, root hash breaks. If state replays, hash matches.

Repo, spec, and invariants: https://github.com/laphilosophia/crypthold

Technical feedback is welcome — especially around invariants, replay model, and failure semantics.

Similar Projects

Security●●Solid

Air – Open-source black box for AI agents (tamper-evident audit trails)

Instead of another observability dashboard, this project builds a provable audit trail: an OpenAI-compatible reverse proxy that vaults prompts in MinIO and links calls with an HMAC-SHA256 tamper-evident chain, plus replay tooling (replayctl) and Jaeger traces. The cryptographic audit chain and the one-line SDK wrap are clever and practical; the real operational work left to teams will be key management and storage/retention strategy.

WizardryNiche Gem
shotwellj
215mo ago