From 51be48adbd6803894c4ecffb402163b5de6cf0a2 Mon Sep 17 00:00:00 2001
From: NguyenND <ngodanguyen@gmail.com>
Date: Fri, 29 May 2026 11:52:46 -0400
Subject: [PATCH] 05/29 Fix new user access Tools --> Security HTTP 429 error

---
 app/static/js/vault.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/static/js/vault.js b/app/static/js/vault.js
index 693e870..6581a66 100644
--- a/app/static/js/vault.js
+++ b/app/static/js/vault.js
@@ -9,6 +9,7 @@ const Vault = (() => {
   let _items = [];
   let _folders = [];
   let _currentView = "vault";
+  let _vaultLoaded = false;
 
   // ── Web-app inactivity / session timeout ──────────────────────────────────
   // Mirrors the extension idle lock. Default 15 min; user can change in
@@ -273,6 +274,7 @@ const Vault = (() => {
         }),
       );
 
+      _vaultLoaded = true;
       renderFolderList();
       renderTagList();
       applyCurrentFilter();
@@ -1094,8 +1096,10 @@ const Vault = (() => {
     const sectionsEl = document.getElementById("security-sections");
     if (!summaryEl || !sectionsEl) return;
 
-    // If vault hasn't loaded yet, wait for it then re-render
-    if (!_items.length && VaultSession.getKey()) {
+    // If vault hasn't loaded yet (first open), wait for it then re-render.
+    // Do NOT reload if the vault was already fetched — that would loop forever
+    // for users with an empty vault.
+    if (!_items.length && VaultSession.getKey() && !_vaultLoaded) {
       summaryEl.innerHTML = '<div class="sec-notice">Loading…</div>';
       sectionsEl.innerHTML = "";
       loadVault().then(() => renderSecurityDashboard());