05/29 Fix new user access Tools --> Security HTTP 429 error

app/static/js/vault.js

@@ -9,6 +9,7 @@ const Vault = (() => {
   let _items = [];
   let _folders = [];
   let _currentView = "vault";
+  let _vaultLoaded = false;
 
   // ── Web-app inactivity / session timeout ──────────────────────────────────
   // Mirrors the extension idle lock. Default 15 min; user can change in
@@ -273,6 +274,7 @@ const Vault = (() => {
         }),
       );
 
+      _vaultLoaded = true;
       renderFolderList();
       renderTagList();
       applyCurrentFilter();
@@ -1094,8 +1096,10 @@ const Vault = (() => {
     const sectionsEl = document.getElementById("security-sections");
     if (!summaryEl || !sectionsEl) return;
 
-    // If vault hasn't loaded yet, wait for it then re-render
-    if (!_items.length && VaultSession.getKey()) {
+    // If vault hasn't loaded yet (first open), wait for it then re-render.
+    // Do NOT reload if the vault was already fetched — that would loop forever
+    // for users with an empty vault.
+    if (!_items.length && VaultSession.getKey() && !_vaultLoaded) {
       summaryEl.innerHTML = '<div class="sec-notice">Loading…</div>';
       sectionsEl.innerHTML = "";
       loadVault().then(() => renderSecurityDashboard());