“”

Vault - Secure Secrets Management Vault - Secure Secrets Management

3 likes

nr_vault / beta

Centralized, secure storage for API keys, credentials, and other secrets with envelope encryption, access control, audit logging, and a secure HTTP client.

This version supports TYPO3

13 LTS 14 LTS

Older versions also support TYPO3

13 LTS 14 LTS


Tags

Get started

Download 0.10.0

Details

Author
Netresearch DTT GmbH
Company
Netresearch DTT GmbH
Last update
11. Jun 2026
First upload
12. Jan 2026
Downloads
18,662
Category
Backend
Dependencies
  • TYPO3 (>=13.4.0 <=14.99.99)
  • PHP (>=8.2.0 <=8.99.99)

Last upload comment

- Prepare 0.10.0 release (#179)
- Prepare 0.10.0 release
- Add per-instance request timeout override to VaultHttpClient (#178)
- Add per-instance request timeout override to VaultHttpClient
- Default runTests.sh to the upper supported PHP bound (#177)
- Default runTests.sh to the upper supported PHP bound
- Update traefik:v3.7 Docker digest to d685879 (#176)
- Update traefik:v3.7 Docker digest to d685879
- Fix actor-type misclassification of CLI and worker reads (#175)
- Fix actor-type misclassification of CLI and worker reads

For details see https://github.com/netresearch/t3x-nr-vault/releases


Downloads by month

Installation

  1. Download ZIP file
  2. Log into your TYPO3 backend
  3. Go to Extension Manager module
  4. Press the upload button on the top bar
  5. Select the ZIP file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.
  1. Go to your folder where the root composer.json file is located
  2. Type: composer require netresearch/nr-vault to get the latest version that runs on your TYPO3 version.
  1. Download T3X file
  2. Log into your TYPO3 backend
  3. Go to Extension Manager module
  4. Press the upload button on the top bar
  5. Select the T3X file and upload it. If you want to overwrite an existing extension installation, activate the checkbox.

Other extensions by this user (14)


Version history

Filter for TYPO3 versions

0.10.0 beta Latest
June 11, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
- Prepare 0.10.0 release (#179)
- Prepare 0.10.0 release
- Add per-instance request timeout override to VaultHttpClient (#178)
- Add per-instance request timeout override to VaultHttpClient
- Default runTests.sh to the upper supported PHP bound (#177)
- Default runTests.sh to the upper supported PHP bound
- Update traefik:v3.7 Docker digest to d685879 (#176)
- Update traefik:v3.7 Docker digest to d685879
- Fix actor-type misclassification of CLI and worker reads (#175)
- Fix actor-type misclassification of CLI and worker reads

For details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.9.0 beta
June 10, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
- Prepare 0.9.0 release (#174)
- Prepare 0.9.0 release
- Per-secret encryption-algorithm marker and atomic audit-chain re-keying on master-key rotation (#173)
- Drop the in-try master-key wipe and trail verification errors
- Bound rotation memory and keep the master-key cache intact
- Cover second master-key rotation with end-to-end functional test
- Re-key audit hash chain atomically during master-key rotation
- Fix peripheral code-review findings in migration, OAuth, and HTTP layers (#172)
- Record encryption algorithm per secret with versioned envelope marker
- Keep fuzzed master-key blobs invalid after trimming
- Reject empty JSON array bodies in secret injection
- Handle escaped quotes in JSON credential redaction
- Harden crypto/key wiping, master-key file loading, and Secret envelope invariant
- Consume guard-test constructions and deduplicate test literals
- Add SSRF tests for IPv6 transition forms
- Reject non-object JSON bodies in secret injection
- Redact quoted credential echoes in OAuth errors
- Include full token identity in OAuth cache key
- Validate OAuth grant config at construction
- Fix UUID v7 variant field random bits
- Fix uid placeholder braces in migration pattern

For details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.8.0 beta
June 09, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
- Prepare 0.8.0 release (#170)
- Prepare 0.8.0 release
- Add Authorization scheme prefix option to vault HTTP client (#169)
- Address review: avoid redundant secret copy and fix docs ordering
- Add Authorization scheme prefix option to vault HTTP client
- Update traefik:v3.7 Docker digest to fcdef59 (#168)
- Update traefik:v3.7 Docker digest to fcdef59
- Update traefik:v3.7 Docker digest to 25cd7b1 (#167)
- Update traefik:v3.7 Docker digest to 25cd7b1
- Reduce cognitive complexity in production code via method extraction (#166)
- Reduce cognitive complexity in production code via method extraction
- Resolve mechanical SonarCloud findings in production code (#165)
- Resolve mechanical SonarCloud findings in production code
- Extract duplicated test literals to class constants (SonarCloud S1192) (#164)
- Keep literal application/json where a const is unreachable from an anonymous class
- Exclude test code from SonarCloud duplication detection
- Extract duplicated test literals to class constants (SonarCloud S1192)
- Resolve mechanical SonarCloud findings in backend JavaScript (#163)
- Resolve mechanical SonarCloud findings in backend JavaScript

For details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.7.0 beta
June 02, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
- Prepare 0.7.0 release (#162)
- Prepare 0.7.0 release
- Document the backend-submodule checklist in AGENTS.md heuristics (#161)
- Document the backend-submodule checklist in AGENTS.md heuristics
- Add secrets usage analytics module and demo-data seeder (#159)
- Unit-test AnalyticsController logic and the StaleSecret value object
- Add the Analytics card to the vault overview and refresh its screenshot
- Document the Vault Analytics module with a screenshot
- Exclude Fluid templates from SonarCloud analysis
- Throw ConfigurationException instead of a generic exception in demo seeder
- Run demo seeding in Development context during ddev install
- Scope demo backdating to the live secret row
- Address PR review and Rector: memoize audit read-split, translation fallback, ARIA values, modernization
- Make analytics service and chain seeder private per DI policy
- Address final review: align neverRotated KPI, fix DI comments, use E2E helpers
- Document Analytics module and vault:seed-demo command
- Address review notes: controller/command count and DemoEvent coverage
- Seed demo data during ddev install
- Add vault:seed-demo command
- Add AuditChainSeeder reconstructing a valid backdated chain
- Add deterministic demo-data specs
- Resolve staleness-rule labels in controller for safe template rendering
- Add Analytics dashboard template and E2E
- Add Analytics submodule controller, registration and labels
- Apply code style to StalenessEvaluator test
- Add VaultAnalyticsService with KPI + redaction-candidate queries
- Add StalenessEvaluator with rule unit tests
- Add analytics value objects
- Add StalenessRule enum
- Add analytics staleness threshold settings
- Fix local ddev start: web image build + mock-oauth healthcheck (#160)
- Preserve a pre-existing policy-rc.d in the ddev web image build
- Set TYPO3 trustedHostsPattern so the v14 backend works over HTTPS
- Take owner

For details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.6.1 beta
May 31, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
- fix: honor literal allowed_hosts in request-time SSRF middleware (#156)
- chore(release): prepare 0.6.1
- fix: honor literal allowed_hosts in request-time SSRF middleware

For details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.6.0 beta
May 31, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
- Release 0.6.0 (#155)
- Release 0.6.0
- Grade-A remediation: security hardening, ACL split, audit enum + scheduler DI fix (#154)
- Gate documentation rendering and tighten project metadata
- Refresh backend module assets and expose JS UI labels
- Harden the AJAX controller and centralise JSON error responses
- Add a vault health probe to the overview module
- Extract pending-secret handling out of the DataHandler hook
- Block IPv6 transition-form addresses in the SSRF guard
- Resolve the secret repository in the scheduler context
- Make secret mutations atomic with their audit record
- Split secret access control into read, write and delete tiers
- Introduce the AuditAction enum and harden the audit log chain
- Cache the master key for the request lifetime (ADR-020)
- Derive the secret checksum as a keyed HMAC over the ciphertext
- docs: land multi-axis review notes (UI/UX/DX + E2E coverage) (#153)
- docs: address PR #153 second-pass review findings
- docs: ADRs 024-028 for this session's architectural decisions (#149)
- fix(security): drop in-memory reveal cache that bypassed the audit log (#151)
- docs: address PR #153 review findings on review notes
- fix: address PR #151 reviewer findings (comment + regression test)
- docs: land multi-axis review notes (UI/UX/DX + E2E coverage)
- chore(deps): update traefik docker tag to v3.7 (#152)
- chore(deps): update traefik docker tag to v3.7
- fix: pin web-dir to .Build/web for local functional tests (#150)
- fix: 3 carried-forward LOW review items (sL fallback + OAuth cache key + redaction) (#148)
- docs: address reviewer findings on ADR-027 and ADR-028
- fix(security): drop in-memory reveal cache that bypassed the audit log
- fix: pin web-dir to .Build/web for local functional tests
- fix: address PR #148 review threads (Gemini HIGH + Copilot findings)
- docs: ADRs 024-028 for this session's architectural decisions
- fix:

For details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.5.0 beta
April 22, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
- fix(ci): drop slsa-provenance job referencing removed reusable workflow (#117)
- ci(release): drop slsa-provenance job referencing removed reusable workflow
- release: v0.5.0 (#116)
- changelog: add v0.5.0 link reference + bump Unreleased compare target
- release: v0.5.0
- chore(deps): consolidate dev deps via typo3-ci-workflows meta-package (#115)
- phpstan: regenerate baseline with auto-registered extensions
- phpstan: drop explicit extension includes (auto-registered by installer)
- chore(deps): consolidate dev dependencies via typo3-ci-workflows meta-package
- chore(deps): update dependency phpunit/phpunit to v13 (#114)
- chore(deps): update dependency phpunit/phpunit to v13
- test: comprehensive testing pyramid + 3 production security fixes (#113)
- fix(tests): call parent::setUp() before v14-gate skip
- fix(tests): reduce OverviewControllerTest to DI-wiring smoke
- fix(tests): vfsStream setup + LanguageService factory for functional smoke
- ci(fixup): resolve CI matrix failures + address review comments
- fix(review): resolve PR #113 review comments
- ci(tests): fix CI matrix failures from first PR push
- test: migrate 100 tests to project bases + mutation-killer assertions + mock hygiene
- test: expand functional, fuzz, and E2E coverage across security-critical paths
- test(refactor): project base classes, traits, fixture builder, architecture check
- fix(cli): reject empty --uid-field in vault:migrate-field
- feat(oauth): fall back to client_credentials when refresh token is rejected
- fix(audit): detect uid gaps in hash-chain verification
- fix(security): deny vault access to disabled BE users + filter stale group IDs
- test(mutation): enable end-to-end Infection + MSI baseline + ratchet plan
- ci: pin reusable workflows to SHA + concurrency + on-demand mutation
- build(tests): xdebug coverage driver, path coverage, strict static analysis
- ci: silence SAST false positives (Fluid templates, test teardown unlink) (#112)
- ci: silence SAST false positives on Fluid templates and test teardown
- security: eliminate DOM-XSS innerHTML sinks and insecure test randomness (#111)
- security: address PR review feedback (a11y, toggle restore, gitleaks scoping)
- security: eliminate innerHTML DOM-XSS sinks and insecure test randomness
- docs(agents): refresh AGENTS.md files with verified project content (#110)
- docs(agents): fix interface signatures and config examples per PR review
- docs(agents): refresh AGENTS.md files with verified commands and content
- chore(deps): update traefik:v3.6 docker digest to 34d5089 (#109)
- chore(deps): update traefik:v3.6 docker digest to 34d5089
- chore(deps): update traefik:v3.6 docker digest to 5e113a2 (#108)
- chore(deps): update traefik:v3.6 docker digest to 5e113a2
- chore(deps): update traefik:v3.6 docker digest to 5ae9c34 (#107)
- chore(deps): update traefik:v3.6 docker digest to 5ae9c34
- fix(rector): skip ext_emconf.php entirely instead of one rule (#106)
- fix(rector): skip ext_emconf.php entirely instead of one rule
- fix(rector): exclude ext_emconf.php from SafeDeclareStrictTypesRector (#105)
- fix(rector): exclude ext_emconf.php from SafeDeclareStrictTypesRector
- fix(rector): add declare(strict_types=1) to ext_emconf.php (#104)
- fix(rector): add declare(strict_types=1) to ext_emconf.php
- chore(deps): update traefik:v3.6 docker digest to 5d1de6b (#103)
- chore(deps): update traefik:v3.6 docker digest to 5d1de6b
- fix: remove empty secrets blocks and fix YAML syntax
- chore: remove explicit gitleaks call, now handled by org-wide default
- fix: add permissions to gitleaks job, remove stale secret from security job
- feat: add direct gitleaks call from netresearch/.github
- fix: use @main for .github reusable workflows, not SHA pin
- chore: migrate generic workflows from typo3-ci-workflows to .github
- chore: migrate to org-wide Renovate preset
- feat(security): HMAC-SHA256 keyed audit hash chain (ADR-023) (#102)
- fix: resolve all PR review comments for HMAC audit chain
- fix: v13 compatibility for UpgradeWizardInterface
- feat: add TYPO3 upgrade wizard for automatic HMAC migration
- feat(security): HMAC-SHA256 keyed audit hash chain (ADR-023)
- fix: resolve all 19 follow-up items with ADRs (#101)
- fix: remove legacy TCA format from looksLikeVaultIdentifier
- fix: resolve PR review comments
- fix: resolve PHPStan errors and CGL fixes in FlexFormVaultHook
- chore: CGL import ordering fix
- test: add mutation CI job, multi-browser E2E, functional tests
- docs: add troubleshooting page, changelog, fix PlantUML, add 6 ADRs
- refactor: improve code quality across multiple layers
- perf: cache master key for request lifetime
- feat: configurable audit read logging for frontend performance
- feat: dedicated OAuthException for targeted error handling
- feat: FlexForm vault secret lifecycle (delete/copy handling)
- Comprehensive quality assessment: security, performance, a11y, docs (#100)
- test: add tests for all new code paths (patch coverage)
- fix: resolve all PR review comments
- feat(i18n): translate Migration Review template
- feat(i18n): translate remaining Migration templates + Rector skip config
- feat(i18n): replace hardcoded English strings with translation keys
- refactor: extract duplicated generateUuid and looksLikeVaultIdentifier
- perf: fix N+1 queries in VaultService::list()
- fix(ci): resolve all CI failures and PR review feedback
- fix: SecretReveal.js GET→POST and EnvironmentMasterKeyProvider COW bug
- fix: resolve test failures and PHPStan errors
- fix: address re-review findings
- docs: fix version mismatches, improve examples, and extend Makefile
- fix(a11y): improve frontend accessibility and error handling
- refactor: code quality improvements from comprehensive review
- perf: optimize frontend rendering and database operations
- fix(security): address critical and high-severity security findings
- chore(deps): update traefik:v3.6 docker digest to 171c9c3 (#99)
- chore(deps): update traefik:v3.6 docker digest to 171c9c3
- chore(deps): update traefik:v3.6 docker digest to acfc806 (#98)
- chore(deps): update traefik:v3.6 docker digest to acfc806
- chore(deps): update traefik:v3.6 docker digest to 3b61960 (#97)
- chore(deps): update traefik:v3.6 docker digest to 3b61960
- fix: allowlist test fixtures and docs in gitleaks config

For details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.4.6 beta
March 07, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
v0.4.6 -- for details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.4.5 beta
March 07, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
v0.4.5 -- for details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.4.4 beta
March 06, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
v0.4.4 -- for details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.4.3 beta
March 02, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
v0.4.3 -- for details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.4.2 beta
March 01, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
v0.4.2 -- for details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.4.1 beta
March 01, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
v0.4.1 -- for details see https://github.com/netresearch/t3x-nr-vault/releases
Download
0.4.0 beta
February 28, 2026
TYPO3: 13 LTS 14 LTS (>=13.4.0 <=14.99.99)
Release v0.4.0
Download
0.3.1 beta
January 26, 2026
TYPO3: 14 LTS (>=14.0.0 <=14.99.99)
Release v0.3.1
Download
0.3.0 beta
January 12, 2026
TYPO3: 14 LTS (>=14.0.0 <=14.99.99)
Release v0.3.0
Download

Get started

Download 0.10.0

Details

Author
Netresearch DTT GmbH
Company
Netresearch DTT GmbH
Last update
11. Jun 2026
First upload
12. Jan 2026
Downloads
18,662
Category
Backend
Dependencies
  • TYPO3 (>=13.4.0 <=14.99.99)
  • PHP (>=8.2.0 <=8.99.99)