| 开发者 |
benridane
presents111 |
|---|---|
| 更新时间 | 2026年6月6日 19:54 |
| PHP版本: | 8.3 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
wp_options table. Anyone with database access — backups, leaked dumps, host migration files — can read them.
Kagivault wraps each AI Connectors key with XChaCha20-Poly1305 (authenticated encryption) and protects the data-encryption key with a vault password derived through Argon2id. The vault password is never persisted, and the vault automatically re-locks after a short, configurable idle timeout. Unlock from the admin UI, and the WordPress AI client transparently sees the decrypted keys — no other plugin changes required.
Highlights
connectors_ai_*_api_key rows)sodium_crypto_aead_xchacha20poly1305_ietf_encrypt)SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13, requires libsodium 1.0.13+)php-sodium, RHEL php-sodium, Alpine php-sodium, Windows official builds) includes both capabilities. The plugin refuses to activate and surfaces a clear admin notice if either is unavailable.
kagivault directory to /wp-content/plugins/.They cannot be decrypted, so AI calls that rely on those keys will not have a key available for that request. Unlock the vault from Settings → Kagivault to restore functionality.
Nowhere. It is held only in browser memory long enough to unlock the vault. The derived data-encryption key lives in a short-lived transient that expires after the configured idle timeout.
Not in this release. Constants and environment variables still take precedence over the encrypted database entries, as defined by core. A later release will add a migration path.
Yes. Kagivault auto-locks after one hour of inactivity by default. Override per environment by defining the constant in wp-config.php:
define( 'KAGIVAULT_IDLE_TIMEOUT', 1800 ); // seconds
The constant always wins over the database setting. Values below 60 seconds are clamped to 60.
KAGIVAULT_IDLE_TIMEOUT constant so the timeout can be overridden from wp-config.php (takes precedence over the database setting).