Group: Seclume

Sort by:Popular▼

✓Popular✓Newest

The proving mechanism: an hprof parser, the heap-dump harness and the shared integration tests. A test tool - it does not belong in an application.

SecretProvider, SecretScope, off-heap cryptography and the pieces the drivers share. No dependencies at runtime.

An HTTPS client for REST APIs whose API key, bearer token or password stays off the heap: the credential header is written from native memory into seclume's own TLS 1.3, request by request, and only ever to the one origin it belongs to. ...

MySQL and MariaDB protocol 4.1, implemented from scratch.

Oracle TNS/NS and TTC, implemented from scratch.

PostgreSQL frontend protocol 3.0, implemented from scratch.

Microsoft SQL Server, TDS 7.4, implemented from scratch.

Private keys that the JVM never holds: decoded by OpenSSL from native memory and kept there, handed to Java as a PrivateKey without its secret parts, and used through a JCA provider of its own. For a server's TLS key (Tomcat, Netty, any ...

A connection pool with no third-party dependencies, fit for virtual threads.

The AWS SDK for Java 2 with the secret access key off the heap: a SigV4 signer whose key is read into native memory and used there, for S3, SQS, DynamoDB and every other client - and for S3-compatible stores such as MinIO or Ceph.

MongoDB through the official Java driver (mongodb-driver-sync) with the password off the heap: a pre-authenticated socket factory that opens the connection, speaks seclume's own TLS 1.3, and authenticates with SCRAM-SHA-256 computed ...

seclume's own MongoDB driver: the wire protocol from the socket up, on seclume's TLS 1.3 and SCRAM-SHA-256 in native memory, behind the interfaces of the official sync API (com.mongodb.client) and with org.mongodb:bson for documents and ...

The official Elasticsearch and OpenSearch Java clients with the API key, token or password off the heap: the client is given a placeholder, and seclume's TLS 1.3 engine writes the secret into each request head from native memory on its ...

Signing keys off the heap: JWTs signed and checked with an HMAC key (HS256/384/512), signed with an RSA or EC private key (RS, PS, ES) held by OpenSSL, and webhook signatures (GitHub, Stripe, any HMAC) checked - the key read from a secret ...

LDAP and Active Directory with the service account's password off the heap: a socket factory for JNDI (and so for Spring LDAP and Spring Security's LDAP support) that encrypts with seclume's own TLS and writes the password of a simple ...

Mail with the password or OAuth token off the heap - sending (SMTP) and receiving (IMAP, POP3). seclume connects, encrypts with its own TLS 1.3 and logs in with PLAIN, XOAUTH2 or the protocol's own login written from native memory; ...

seclume's own MongoDB driver behind the reactive API of the official driver (com.mongodb.reactivestreams.client): Reactive Streams publishers over the sync driver, each subscription on a virtual thread.

NATS with the NKey seed, password or token off the heap: an AuthHandler that signs server challenges in native memory with Ed25519 (for bare NKey seeds and .creds files), and a DataPort whose connections encrypt with seclume's own TLS 1.3 ...

seclume's drivers as Quarkus datasource kinds: seclume-postgresql, seclume-mysql, seclume-sqlserver, seclume-oracle.

R2DBC for reactive applications (Spring WebFlux, Spring Data R2DBC) over seclume's JDBC drivers: the same protocols, TLS, secret providers and session reset, each connection's calls run in order on a virtual thread of its own, and no ...