Changelog

v1.0.5 — PHP Security Update

• Release Date: October 21, 2026

This release updates the bundled PHP runtime to address critical PHP security vulnerabilities. No Secryn code changes or data migrations are required.

Security improvements

• Updated PHP to 8.4.27 (serversideup/php 8.4.27 base image), which fixes CVE-2026-109618 and CVE-2026-109619 from the PHP project's October 21, 2026 security release.

How to update

• See Updating Secryn.

v1.0.4 — Private Key Encryption and Public Link Hardening

• Release Date: October 15, 2026

This release encrypts private keys at rest and ensures public links never expose private key material.

Security improvements

• Private keys and certificate private keys are now encrypted at rest using the application key (APP_KEY).
• Encrypted private material is stored in a versioned SECRYN-PRIVATE-V1 envelope.
• Public certificate and key links now return only public material.
• Private keys are no longer served through public links under any circumstances.

Fixes

• Fixed public links exposing private key material.
• Fixed private keys being stored unencrypted on disk.

v1.0.3 — Multi-Factor Authentication and Security Improvements

• Release Date: September 15, 2026

This release adds native multi-factor authentication, strengthens authorization across sensitive operations, and improves the installation experience.

New

• Added native multi-factor authentication.
• Email verification codes are the default MFA method.
• Administrators can optionally enable authenticator-app MFA using QR codes.
• Authenticator-app MFA includes one-time recovery codes.
• Added MFA challenges after Google, GitHub, Twitter, and Apple sign-in.
• Added dashboard settings for global MFA requirements and MFA method selection.
• Added administrator controls for managing user MFA access and resetting enrollment.

Security improvements

• Administrators are now required to use MFA.
• Protected pages remain inaccessible until MFA setup or verification is completed.
• MFA verification attempts are rate-limited.
• Permanent deletion now requires administrator authorization and password confirmation.
• Permanent deletion events are recorded without exposing secrets or private keys.
• Strengthened authorization across vaults, secrets, keys, certificates, exports, backups, archived resources, admin operations, API operations, and MCP operations.
• Improved protection against cross-vault and restricted-vault access.
• Hardened API authentication responses and request logging to reduce sensitive-data exposure.
• Expanded user activity logging for registration, login, and logout events.

Installation improvements

• Reworked the installation wizard into a guided, sequential process.
• Each step must be completed before the next step becomes available.
• “Next” now saves the current step and automatically advances the wizard.
• Added SMTP delivery verification before installation can be finalized.
• Test messages are sent directly to the administrator’s email address.
• Invalid SMTP settings no longer risk permanently locking administrators out.
• Installation progress can safely resume after refreshing or reconnecting.
• Locked installations now redirect /install visitors to the login page.
• Installation endpoints become unavailable after installation is locked.

Fixes

• Fixed access to protected pages before completing MFA.
• Fixed mandatory MFA being disabled from user profiles.
• Fixed MFA behavior after global settings changes.
• Fixed recovery-code authentication for authenticator-app MFA.
• Removed recovery codes from email-based MFA, where they are unnecessary.
• Fixed permanent vault deletion bypassing password confirmation.
• Fixed installer tabs unexpectedly returning to the previous step.
• Fixed inconsistent authorization checks across sensitive operations.
• Improved MFA wording and status information throughout account and administrator settings.

v1.0.2 — MCP Server Bug Fixes

• Release Date: August 13, 2026

This patch release focuses primarily on bug fixes and stability improvements for the MCP server.

• Fixed issues affecting MCP server reliability.
• Improved MCP request handling and error responses.
• Resolved minor MCP server integration issues.

v1.0.1 — Bug Fixes

• Release Date: March 11, 2026

This patch release includes two targeted bug fixes:

• Fixed an issue when creating a restricted vault.
• Fixed an issue when copying the vault ID for CLI usage.

v1.0.0 — Initial Release

• Release Date: 28 Feb 2026

We’re excited to introduce Secryn v1.0.0, the first public release of our fully self-hosted secret, key, and certificate management platform. This version delivers the complete foundation of the Secryn architecture, built with a focus on security, simplicity, versioning, and full data ownership.

Below is a summary of everything included in the initial release.

Core Platform

• Project-based organization structure
• Support for multiple Vaults per Project
• Restricted Vaults for tighter per-vault access control
• Clean, modern UI built with Vue + shadcn
• Full audit, request, and user activity tracking
• Comprehensive App Settings panel (branding, SMTP, theme overrides, etc.)
• Installation wizard for first-time setup
• Backup and restore. Archives are encrypted with AES-256-GCM. Private key files inside the archive are not separately application-encrypted

Secrets Management

• Create, update, delete, and restore secrets
• Secret versioning with unlimited history
• One-click restore to any previous version
• Optional masked or revealed secret display
• Expiration support with scheduled alerting
• Public secret-name listing via API (with vault access key)

Key Management

• RSA and EC key generation
• Support for 2048, 3072, and 4096-bit RSA keys
• Upload existing private keys
• Per-key public URL support (optional)
• Automatic visibility control (public/private)
• Expiration support and rotation reminders
• Vault-scoped key access via API

Certificate Management

• Create self-signed certificates
• Upload existing certificates
• Download certificate + private key bundle
• Per-certificate public URL support (optional)
• Expiration tracking and notifications
• Certificate metadata + lifecycle history
• Vault-scoped certificate access via API

User Management & RBAC

• Users are added at the Project level
• Four predefined roles: Admin, Project Manager, Contributor, Read-Only
• Role capabilities enforced across Web UI and API
• Restricted Vault rules override project access
• Role & Permissions matrix with modal view

API & Access Model

• Vault-level access keys for secure API access
• Get secrets, keys, certificates via API
• Fetch a single resource or filtered groups
• Public resource access when visibility is enabled
• Full REST API documentation

MCP Server (AI Integration)

• Built-in Secryn MCP server for agent-based secret retrieval
• Supports secret, key, and certificate requests
• Validates vault ID + access key automatically
• Health check endpoint for agent initialization
• Configurable via Installation Wizard and App Settings

Scheduling & Email Notifications

• Automatic expiration reminders at 90/60/30/14/7/1 days
• Digest emails (daily/weekly) to all admins
• SMTP configuration with live test support
• Global “Allow Email Notifications” user preference

Backups & Restore

• Full database backup
• Backup archive encrypted with AES-256-GCM
• Backup key handling workflow for restore operations
• Restore workflow with overwrite protection

Logs

• Audit Logs — who changed what
• Request Logs — what API endpoints were called
• User Logs — login attempts, IPs, timestamps
• Searchable, filterable views
• Export options

Developer & Deployment

• Docker-compatible
• Spin Pro supported
• Reverse proxy friendly (Traefik/Nginx)
• Environment-based configuration
• REST + MCP for extensibility

v1.0.0 Summary

This release establishes Secryn as a complete, self-hosted foundation for securely managing secrets, keys, and certificates with strong RBAC controls, versioning, API accessibility, and AI agent compatibility.

All further versions will build on top of this baseline.