05/18 Update documents

README.md

@@ -19,13 +19,13 @@ A self-hosted, zero-knowledge password manager — web app and Chrome/Firefox ex
 - **Proactive health notifications** — sidebar badge and dismissible banner on vault load when breached, weak, or reused passwords are detected; HIBP runs in the background without blocking the UI; results cached so opening the Security tab is instant
 - **Import / Export** — encrypted JSON backup; CSV export (plaintext, handle carefully); import from Chrome, Bitwarden, and 1Password CSV formats (RFC 4180 compliant parser)
 - **Account MFA** — TOTP-based login (Google Authenticator / Authy); single-use code enforcement prevents replay attacks
-- **Passkeys / WebAuthn** — register device biometrics or hardware keys as a sign-in method; master password still required to unlock vault (zero-knowledge preserved); manage passkeys in Account Settings
+- **Passkeys / WebAuthn** — register device biometrics or hardware keys (YubiKey, cross-device QR) as a sign-in method; master password still required to unlock vault (zero-knowledge preserved); manage passkeys in Account Settings; transport type shown per credential (📱 Device / 🔑 Security key)
 - **Master password change** — atomic zero-knowledge re-encryption of entire vault including item names
 - **Account recovery** — 128-bit recovery code; server never stores it; challenge-response proof prevents forgery
 - **Audit log** — server-side trail of all create/edit/delete/import/export actions; no plaintext names ever logged
 - **Encrypted item names** — `enc_name`/`iv_name`; server holds only the item type as a label
 - **Browser history** — back/forward button works for all views (`history.pushState`)
-- **Web-app auto-lock** — configurable inactivity timeout (5/10/15/30/60 min or Never); stored per browser in `localStorage`
+- **Web-app auto-lock** — configurable inactivity timeout (5/10/15/30/60 min or Never); also locks immediately when tab is hidden (screen lock, minimize) for longer than the timeout
 - **Clipboard auto-clear** — sensitive copies cleared after 30 seconds
 - **Responsive layout** — phone, tablet, laptop, large desktop; collapsible sidebar
 
@@ -79,6 +79,8 @@ Sharing:  ECDH(Alice_priv, Bob_pub) ──► sharedKey ──► AES-256-GCM(en
 - **Audit log privacy** — item names and shared item names never appear in server-side audit logs
 - **Extension fingerprinting** — `web_accessible_resources: []` blocks external pages from probing extension files
 - **Passkey / WebAuthn** — FIDO2 assertion proves identity to the server without a password; vault key still derived from master password client-side; `sign_count` updated on each use for clone detection
+- **Password age tracking** — `password_changed_at` stored inside encrypted blob; security dashboard uses actual password change date, not item creation date
+- **Emergency access stale snapshot detection** — server flags provisioned snapshots created before the `enc_name` fix; UI prompts grantor to re-provision
 
 A database breach exposes only encrypted ciphertext. The server cannot read vault names, passwords, tags, or shared item names.