Haventec Sanctum changelog

Release 1.2.28 (08/04/2021)

• Extra validation on vault credentials input

Release 1.2.25 (18/08/2020)

• Small File Vault support
• File Vault SDK (Beta) released, please contact Haventec to get access to these
• Fixed edge case where vault was incorrectly being displayed in application

Release 1.2.23 (31/03/2020)

• Calling a get-start or update-start API with invalid vault credentials, will no longer lock the vault when the transaction expires

Release 1.2.22 (24/03/2020)

• Several internal security improvements
• Console bug fixed where toggling the IP whitelist was not saving properly

Release 1.2.21 (04/02/2020)

• Bug fix Error uuid is now returned.
• Default rate limits are applied to newly created applications.
• Payloads are now being returned on small content generic vaults, rather than returning a null value

Release 1.2.20 (29/10/2019)

• Bug fix on rare race conditions when transacting

Release 1.2.19 (02/10/2019)

• Active vaults shown are not affected by vault transactions.
• Bug fix on certain race conditions when transacting

Release 1.2.18 (22/8/2019)

• Audit entries generated when a trying to delete, update or get a vault due to bad credentials
• Application admins are able view application Ratelimits
• Application admins are able to update the public key for JWT secured applications

Release 1.2.17 (14/8/2019)

• Vaults can be unlocked if it has been locked due to too many failed get-start API calls
• Users are now able to delete CIDR whitelist entries for their application

Release 1.2.16 (8/7/2019)

• IP Whitelisting has been introduced, allowing all new and existing sanctum applications to enable/disable whitelisting of IPv4 IP addresses or CIDR ranges

Release 1.2.15 (13/6/2019)

• API rate limiting introduced for all online and offline vault API’s with a default value of 25 requests per second. Click here more details
• Vaults can now be locked within Haventec Console
• Vaults can now be deleted within Haventec Console
• The application dashboard will now also display:
• The total amount of vaults in your application
• The total amount of active vaults since the start of the month
• The total amount of vaults being transacted since the start of the month
• UX Changes
• Live reload available for vault and audit listings
• The configured public key and claims can be viewed for JWT secured applications within the application details dashboard

Release 1.2.14 (30/4/2019)

• Removal of one-year auto expiry restriction for generic online and offline vaults
• Bug fix: Addition of required CORS headers (x-api-key) in responses
• API key check fails that occur on API's where the API key is specified within the request body will now provide additional detail in the audit items such as IP address of the requestor and the HTTP endpoint
• Advanced search function for Sanctum audit items in Haventec Console
• Advanced search function for Sanctum vaults in Haventec Console

Release 1.2.13 (13/2/2019)

• Performance fixes for vault interactions

Release 1.2.12 (18/1/2019)

• Newly created applications can be configured to require JWT validation for Offline vaults. Currently accepts ECDSA using P-384 curve and SHA-384 hash algorithm
  • Public key and claims can be configured within Haventec Console. Click here for more information
• Validation of URI path variables added
• Stronger security measures added to Offline Credit Card vaults as well as performance improvements
• Bug fixes

Release 1.2.11 (15/11/2018)

• View audit items for a given application in Haventec Console
• Metadata key-value pairs can now be associated with your Online/offline vaults
• Performance improvements for reading and updating vaults
• More accurate audit item events (With renaming and removal of REGISTER_VAULT entries when reading a vault):

  Event	Audit item (Old scheme)	Audit item (New scheme)
  Creating a vault	REGISTER_VAULT	CREATE_VAULT
  Reading a vault	REGISTER_VAULT, START_USE_VAULT	READ_VAULT
  Acknowledge receipt of new read vault	COMPLETE_USE_VAULT	ACKNOWLEDGE_READ_VAULT
  Updating a vault	Not available in previous versions	UPDATE_VAULT
  Updating a vault	Not available in previous versions	UPDATE_VAULT
  Acknowledge receipt of new updated vault	Not available in previous versions	ACKNOWLEDGE_UPDATE_VAULT
  Deleting a vault	DELETE_VAULT	DELETE_VAULT

Release 1.2.10 (22/10/2018)

• Introduction of generic online vaults (Allows any data, not just credit card data to be stored within online vaults)
• View registered vaults for a given application in Haventec Console
• API key checks in the headers (x-application-uuid AND x-api-key) for existing API’s (Please ensure your applicationUuid and apiKey are added):
  • Offline
    • Credit Card
      • PUT /vault/credit-card/offline/{vaultUuid}/get-end
      • GET /vault/credit-card/offline/{vaultUuid}/info
      • PUT /vault/credit-card/offline/{vaultUuid}/update-end
    • Generic
      • PUT /vault/generic/offline/{vaultUuid}/get-end
      • GET /vault/generic/offline/{vaultUuid}/info
      • PUT /vault/generic/offline/{vaultUuid}/update-end
  • Online
    • Credit Card
      • GET /vault/credit-card/online/{vaultUuid}/info
      • PUT /vault/credit-card/online/{vaultUuid}/get-end

Release 1.2.9 (25/09/2018)

• Updating of vault contents for credit card offline and generic offline vaults
  • Update vault contents for credit card offline
    • POST /vault/credit-card/offline/{vaultUuid}/update-start
    • POST /vault/credit-card/offline/{vaultUuid}/update-end
  • Update vault contents for generic offline
    • POST /vault/generic/offline/{vaultUuid}/update-start
    • POST /vault/generic/offline/{vaultUuid}/update-end
• Introduction of applicationUuid and apiKey checks within the headers of the following API's
  • PUT /vault/credit-card/offline/{vaultUuid}/get-end
  • GET /vault/credit-card/offline/{vaultUuid}/update-end
  • GET /vault/credit-card/offline/{vaultUuid}/info
  • PUT /vault/generic/offline/{vaultUuid}/get-end
  • GET /vault/generic/offline/{vaultUuid}/update-end
  • GET /vault/generic/offline/{vaultUuid}/info
  • PUT /vault/credit-card/online/{vaultUuid}/get-end
  • GET /vault/credit-card/offline/{vaultUuid}/info
• Update of swagger api documentation to be more clear
• Minor bug fixes:
  • Vaults are being displayed within Haventec Console
  • More descriptive errors for sanctum application creation
  • Vaults didn’t allow the storage of symmetric keys