AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →Secure coding rating: 30/100How this score is computedA product with no known CVEs starts at a neutral score and climbs the longer it goes without one; a product with known CVEs is penalized by severity instead. This one has 3 known CVEs (vendor-level match — see the CVE list below) and is tracked as ~107 days old in our catalog (a stand-in for real release date, which we don't track). The platform admin controls the formula's weights.
Image-based passwordless authentication and data protection using PQC
Known CVEs (3)About this listSourced from the public NVD database, matched by vendor name. Shown here at the vendor level — we don't track per-product/version data, so a listed CVE may affect a different product from this vendor, not necessarily this one. “New” means published within the last 30 days. “Actively exploited” means CISA's Known Exploited Vulnerabilities (KEV) catalog confirms real-world exploitation, not just a theoretical severity score. An “EPSS” chip appears at 10% and above: that is FIRST's estimated chance of exploitation in the next 30 days, which measures likelihood rather than impact and so can differ sharply from the severity beside it.
n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external nam…
In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault.…
Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
What it does
Secrets Vault offers post-quantum security solutions that enable image‑based passwordless authentication and data protection for organizations modernizing identity. The platform derives cryptographic keys from ordinary images, supports edge biometrics and NFC identity verification, and provides secure storage and sharing of sensitive data while integrating with existing IAM systems.
Strengths
Image-based cryptographic key derivation from ordinary images
Biometric matching and liveness verification run locally on the user’s device
Uses NIST‑standardized post‑quantum algorithms
Cryptographic keys derived locally on demand and never stored persistently
Flexible deployment options including SaaS, cloud, and on-premises
Trusted ID verification using official IDs for identity assurance
News about Secrets Vault (6)Where this comes fromItems from Secrets Vault's own public feeds — changelog, blog, GitHub releases or status page — that name Secrets Vault in the headline or summary. News from Secrets Vault that does not name this product is on the vendor's page instead. Each headline links to the original source; nothing here is written by 0-Doubt.
