Crypta v0.2.0-alpha — Security Verifier Hardening

Crypta v0.2.0-alpha

This second alpha release expands Crypta from a zero-trust secure communication scaffold into a more hardened runtime prototype with dedicated security verification, stricter request handling, and deployment guardrails.

Highlights

• Added a dedicated Crypta security verifier service with HTTP validation endpoints and test coverage.
• Wired verifier checks into sensitive backend service flows and admin-facing security verification APIs.
• Added production readiness health checks for required runtime secrets, token peppering, verifier configuration, and persistence assumptions.
• Hardened session authentication with token peppering and replay-focused WebAuthn coverage.
• Added sensitive route rate limiting for bootstrap, authentication, admin, and governance paths.
• Restricted CQL results to allowlisted audit columns and disabled placeholder Smalltalk governance execution by default.
• Added verifier Docker Compose wiring and Kubernetes deployment, service, HPA, and network policy manifests.
• Added default-deny and verifier-specific Kubernetes network policies.
• Expanded backend flow and security-oriented tests around ownership checks, bootstrap sessions, tokens, CQL, and verifier behavior.
• Improved documentation for verifier hardening boundaries, backend run commands, governance, threat modeling, deployment, and project support.

Status

Crypta remains an alpha-stage security architecture and implementation scaffold. This release is intended for review, experimentation, and portfolio or research use, not production deployment without external audit and further cryptographic validation.

Validation

• Maven backend test suite completed successfully locally.
• Docker-backed integration coverage was skipped locally because Docker was unavailable in the current environment.

Crypta v0.1.0-alpha — Zero-Trust Secure Communication Platform Scaffold

Crypta v0.1.0-alpha

Crypta is a zero-trust, end-to-end encrypted communication platform scaffold designed for high-risk corporate, executive, and security-sensitive environments.

This alpha release introduces the core backend, mobile contracts, governance layer, and deployment foundation for a secure messaging system where the server stores and processes only encrypted ciphertext envelopes.

Highlights

• Spring Boot backend for secure communication APIs
• WebAuthn/passkey-based authentication flow
• Bearer-token session model with hashed token storage
• Zero-trust message ingestion with ciphertext-only persistence
• Plaintext prevention guard for rejecting unsafe metadata payloads
• Signal-style key infrastructure with identity keys, signed prekeys, one-time prekeys, and post-quantum prekey storage
• Key transparency log for tracking public-key history
• Tamper-evident audit logging with hash-chained events
• Encrypted attachment upload/download flow
• Emergency organization and room lockdown controls
• Device trust and attestation tracking
• Flutter mobile client scaffold with cryptographic provider contracts
• Docker, Docker Compose, and Kubernetes deployment files
• Compliance Query Language using ANTLR
• Embedded Smalltalk-style policy engine for governance rules

Tech Stack

• Java / Spring Boot
• Spring Security
• PostgreSQL
• Flutter / Dart
• Docker
• Kubernetes
• ANTLR
• Smalltalk policy engine
• WebAuthn / Passkeys
• PQXDH / Signal-style cryptographic architecture
• MLS-inspired group messaging architecture

Status

This is an alpha release. It should be treated as a security-focused architecture and implementation scaffold, not as a production-certified secure messenger.

Before production use, the project still needs full cryptographic implementation review, external security audit, mobile native secure-key integration, load testing, threat-model validation, and formal documentation of deployment assumptions.

Recommended Use

Use this release for:

• Security architecture demonstration
• Academic or portfolio presentation
• Backend API experimentation
• Secure messaging system prototyping
• Zero-trust communication platform research