Coffre began as a small Bash version. The goal was not to compete with mature password managers. I wanted a problem that would force me to connect cryptography, authentication, backend design, and browser behavior.
“Store a password securely” sounds like one requirement. It immediately expands:
- Where is the encryption key created?
- Does the server ever see material that can decrypt the vault?
- How is a wrong password distinguished from corrupted data?
- What does a session prove, and for how long?
- How is a second factor enrolled without leaving its secret exposed?
- What happens to a copied password after it reaches the clipboard?
The interface was not the architecture
I moved from Bash to HTML, then a template-based version, then the current web UI. Each interface felt like progress, but the important changes were invisible: deriving separate keys with HKDF instead of reusing one key, retrieving one password separately from listing entry names, and making nonces expire and become unusable after one request.
The UI could look finished while the trust model was still unfinished.
Building created the syllabus
I did not begin with a complete list of everything needed for a password manager. The project generated that list as it failed: Argon2id, authenticated encryption, OTP enrollment, rate limiting, temporary state, database design, email verification, browser crypto, deployment constraints, logging, and XSS review.
That is the development loop I want SoyezSecurise to keep: understand the problem, build the system, attack the assumptions, then refine the architecture. The result takes longer than a portfolio mockup. It also teaches more than one.