diff --git a/CHANGELOG.md b/CHANGELOG.md
index fcadd58..97a4a71 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,39 +1,56 @@
 # cveClient Changelog
 
-Version 1.0.22 2025-06-26
-* Resolved a bug as filled in #31 multiple versions under affected tree
-* Moved from jquery .data() to .attr(data- to avoid unexpected behaviors.
-* ProblemTypes can be array of array with only one dictionary object - fixed issue where m*n array can be consisten in JSON view and Friendly (Minimal) view.
+## Version 1.0.24 — 2026-03-28
 
-Version 1.0.21 2025-06-24
-* Added a new version of CVE Chatbot
-* Ask chatGPT button
-* Fixed bugs on multi-row elements
+- Security: Fixed XSS vulnerability — use `.text()` instead of `.html()` for CVE ID in modal title
+- Security: Prevent plaintext API key storage and harden encryption key handling
+- Security: Added prototype pollution protection to `queryParser` and removed sensitive logging
+- Updated SweetAlert2 from 11.4.9 to 11.26.24
+- Made schema references version-agnostic with automatic schema version detection
+- Added ADP (Authorized Data Publisher) read and delete support
 
+## Version 1.0.23 — 2025-12-15
 
-Version 1.0.20  2023-08-21
+- Updates to resolve bugs including security issues (CVE-pending)
+- Updates after demo to CVE AWG
+- Login bug fixes
+- Updated `check_json` function validation
 
-* Add schemaToJson.js generic library to support conversion of CVE schema
-* Added updates to support viewing of full schema as presented by CVE5.0 schema
+## Version 1.0.22 — 2025-06-26
 
+- Resolved a bug as filed in #31 — multiple versions under affected tree
+- Moved from jQuery `.data()` to `.attr("data-")` to avoid unexpected behaviors
+- ProblemTypes can be array of array with only one dictionary object — fixed issue where m\*n array can be consistent in JSON view and Friendly (Minimal) view
 
-Version 1.0.19  2023-08-21
+## Version 1.0.21 — 2025-06-24
 
-* Fixed some bugs on cveInterface.js related to apply_diff
-* Added the ability to download CVE JSON from repositories for edit/duplicate
-* Moved display capabilities using CSS.
+- Added a new version of CVE Chatbot
+- Ask ChatGPT button
+- Fixed bugs on multi-row elements
+- Added `cwe-common.json` for CWE autocomplete lookup
 
+## Version 1.0.20 — 2023-08-21
 
-Version 1.0.18  2023-08-09
+- Added `schemaToForm.js` generic library to support conversion of CVE schema
+- Added updates to support viewing of full schema as presented by CVE 5.0 schema
 
-* Fixed some bugs on cveInterface.js related to from_json and to_json routines
-* The cveclientLib on 1.0.14 now support ADP capability
-* The User Management interface bug fixes on duplicate ID or duplicate name field fixed.
-* ADP client interface is available only via JSON editor at this time.
-* Require at least One product to have STatus  "affected" or "unknown".
+## Version 1.0.19 — 2023-08-21
 
-Version 1.0.17  2023-08-09
-* Allow entry of CVE data without being logged in just to create mock records
-* Implemented offload download button for CVE records
-* Fixed XSS issue due to changes to CVE Services RSUS interface
-* Pagination issues resolved
+- Fixed bugs on `cveInterface.js` related to `apply_diff`
+- Added the ability to download CVE JSON from repositories for edit/duplicate
+- Moved display capabilities using CSS
+
+## Version 1.0.18 — 2023-08-09
+
+- Fixed bugs on `cveInterface.js` related to `from_json` and `to_json` routines
+- The `cveClientlib.js` on 1.0.14 now supports ADP capability
+- User Management interface bug fixes on duplicate ID or duplicate name field
+- ADP client interface is available only via JSON editor at this time
+- Require at least one product to have status "affected" or "unknown"
+
+## Version 1.0.17 — 2023-08-09
+
+- Allow entry of CVE data without being logged in just to create mock records
+- Implemented offload download button for CVE records
+- Fixed XSS issue due to changes to CVE Services RSUS interface
+- Pagination issues resolved
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..4e60ac5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,118 @@
+# Contributing to cveClient
+
+This guide covers the technical details for developers contributing to cveClient.
+
+## Architecture
+
+cveClient is a pure client-side JavaScript application with no backend, no build system, and no transpilation.
+
+### Core Files
+
+| File                                         | Description                                                                                                                                                                                                           |
+| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`cveClientlib.js`](./cveClientlib.js)       | Reusable API client library. Class `cveClient` wraps the CVE Services REST API with `rfetch()` (Fetch API wrapper that injects API key auth). Methods for CVE CRUD, user management, and org info.                    |
+| [`cveInterface.js`](./cveInterface.js)       | Main UI logic (~2000 lines). Handles login/logout, CVE operations, user management, and form-to-JSON conversion.                                                                                                      |
+| [`schemaToForm.js`](./schemaToForm.js)       | Dynamically generates HTML forms from the CVE JSON 5.x schema. Bidirectional: `FormToObject()` extracts JSON from form fields, `ObjectToForm()` populates forms from JSON. Fields linked via `data-field` attributes. |
+| [`autoCompleter.js`](./autoCompleter.js)     | Autocomplete/suggestion UI for input fields with dynamic URL fetching (used for CWE lookup).                                                                                                                          |
+| [`encrypt-storage.js`](./encrypt-storage.js) | RSA-OAEP 4096-bit encryption for API keys in browser storage using Web Crypto API + IndexedDB for key persistence.                                                                                                    |
+| [`index.html`](./index.html)                 | Single-page app with Bootstrap modals for all operations.                                                                                                                                                             |
+
+### How It Works
+
+1. User logs in with CNA short name, username, and API key
+2. API key is encrypted and stored in browser storage (localStorage or sessionStorage)
+3. All API calls go directly from the browser to CVE Services — no proxy or middleware
+4. The CVE JSON 5.x schema is fetched at runtime from the [CVE Schema Project](https://github.com/CVEProject/cve-schema) to dynamically generate the "All Fields" form
+5. Form data is converted to/from CVE JSON using `data-field` attribute mappings
+
+### Key Patterns
+
+- Heavy jQuery DOM manipulation with Bootstrap modals
+- Promise-based async/await for all API calls
+- State: global `client` object (session), localStorage/sessionStorage (credentials), IndexedDB (encryption keys)
+- Dynamic HTML generation for array fields (versions, descriptions, references) using `duplicate()`/`unduplicate()`
+- Version branches named `version-X.X.X`, PRs merged to `main`
+
+## Local Development
+
+There is no build step. Serve the files from any local web server:
+
+```bash
+python3 -m http.server 8080
+# or
+npx serve .
+# or
+php -S localhost:8080
+```
+
+Then open `http://localhost:8080` in your browser.
+
+**Note:** Opening `index.html` directly from the filesystem (`file://`) will not work — browsers block network requests from local files.
+
+## Using cveClientlib in Node.js
+
+The `cveClientlib.js` file includes conditional exports for Node.js environments. You can use it directly in Node.js scripts (`fetch` is available natively in Node 18+):
+
+```javascript
+const cveClient = require("./cveClientlib.js");
+
+const client = new cveClient(
+  "your_org_short_name",
+  "your_username",
+  "your_api_key",
+  "https://cveawg.mitre.org/api",
+);
+
+// Get CVE details
+client.getcvedetail("CVE-2024-1234").then(function (cve) {
+  console.log(JSON.stringify(cve, null, 2));
+});
+
+// Reserve a CVE ID
+client.reservecve(1).then(function (result) {
+  console.log("Reserved:", result);
+});
+
+// Get org quota
+client.getquota().then(function (quota) {
+  console.log("Quota:", quota);
+});
+```
+
+For older Node.js versions without native `fetch`, use [node-fetch](https://github.com/node-fetch/node-fetch):
+
+```javascript
+const fetch = require("node-fetch");
+globalThis.fetch = fetch;
+const cveClient = require("./cveClientlib.js");
+```
+
+## Running Tests
+
+Tests use [Vitest](https://vitest.dev/) with jsdom. Requires Node.js 22+.
+
+```bash
+npm ci
+npm test
+```
+
+Test suites:
+
+- **Pure function tests** (24 tests) — `get_deep`, `set_deep`, `simpleCopy`, `checkurl`, `check_json`, `queryParser`
+- **Security regression tests** (13 tests) — prototype pollution protection, XSS prevention via `safeHTML` and `cleanHTML`
+- **API client tests** (14 tests) — URL construction, auth headers, CVE/ADP operations
+
+## Dependencies
+
+All dependencies are for the HTML UI only. The `cveClientlib.js` library has zero dependencies.
+
+| Library                                         | Version | Source | Integrity   |
+| ----------------------------------------------- | ------- | ------ | ----------- |
+| [jQuery](https://jquery.com/)                   | 3.5.1   | CDN    | SHA-384 SRI |
+| [Bootstrap](https://getbootstrap.com/)          | 4.3.1   | CDN    | SHA-384 SRI |
+| [Popper.js](https://popper.js.org/)             | 1.14.7  | CDN    | SHA-384 SRI |
+| [Bootstrap-Table](https://bootstrap-table.com/) | 1.19.1  | CDN    | SHA-384 SRI |
+| [SweetAlert2](https://sweetalert2.github.io/)   | 11.x    | Local  | —           |
+| [Ace Editor](https://ace.c9.io/)                | 1.2.4   | Local  | —           |
+
+CDN dependencies use [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) (SRI) checks. SweetAlert2 and Ace Editor are served from local copies due to build issues with their CDN versions — please review their respective license agreements.
diff --git a/INSTALL.md b/INSTALL.md
index c235ba0..b367697 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -1,12 +1,78 @@
-### Installing cveClient on your webserver (apache2, IIS, nginx, tinyhttp)
+# Installing cveClient
 
-All the files in this repository are client utilities expected to served from a webserver to run inside a web browser.  Directly accessing the index.html file inside a browser will NOT work as most browsers will not allow network activity from static files on your local or network attached drive/storage.
+cveClient is a pure static web application — all files are served directly to the browser with no build step, no transpilation, and no server-side processing.
 
-Clone this repository to a web accessible folder in your webserver says into a folder called `cveClient` using git command `git clone https://github.com/CERTCC/cveClient`.  Once you have cloned this folder, you can visit your webserver's relative URL at `/cveClient/` to the folder where the repository was cloned. Ensure your webserver's default index file is `index.html`
+## Quick Start (Local Development)
 
-If you use Content-Security-Policy (CSP) headers on your webserver or on your web reverse proxy, make sure the appropriate domain URLs are allowed for the folder that was cloned (`cveClient`). Below is the sample Content-Security-Policy header recommended for this folder:
+Any local web server will work. Pick whichever you have installed:
 
-`default-src 'self' blob: http://127.0.0.1:* http://localhost:*; connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org; script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:; style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com; img-src 'self' data: blob:;object-src 'self'`
+```bash
+# Python
+python3 -m http.server 8080
 
+# Node.js
+npx serve .
 
+# PHP
+php -S localhost:8080
 
+# Ruby
+ruby -run -e httpd . -p 8080
+```
+
+Then open `http://localhost:8080` in your browser.
+
+**Note:** Opening `index.html` directly from the filesystem (`file://`) will not work — browsers block network requests from local files.
+
+## Production Deployment (Apache, Nginx, IIS)
+
+Clone the repository into a web-accessible folder on your web server:
+
+```bash
+git clone https://github.com/CERTCC/cveClient.git /var/www/html/cveClient
+```
+
+Then visit your server's URL at `/cveClient/`. Ensure your web server's default index file includes `index.html`.
+
+### Content-Security-Policy
+
+If you use Content-Security-Policy (CSP) headers on your web server or reverse proxy, the following CSP is recommended for the cveClient folder:
+
+```
+default-src 'self' blob: http://127.0.0.1:* http://localhost:*;
+connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org;
+script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:;
+style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com;
+img-src 'self' data: blob:;
+object-src 'self'
+```
+
+### Apache Example
+
+Add to your `.htaccess` or virtual host configuration:
+
+```apache
+<Directory /var/www/html/cveClient>
+    Header set Content-Security-Policy "default-src 'self' blob: http://127.0.0.1:* http://localhost:*; connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org; script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:; style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com; img-src 'self' data: blob:; object-src 'self'"
+</Directory>
+```
+
+### Nginx Example
+
+```nginx
+location /cveClient/ {
+    add_header Content-Security-Policy "default-src 'self' blob: http://127.0.0.1:* http://localhost:*; connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org; script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:; style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com; img-src 'self' data: blob:; object-src 'self'";
+}
+```
+
+## CVE Services Endpoints
+
+The application connects to one of three CVE Services environments, selectable at login:
+
+| Environment | URL                                 |
+| ----------- | ----------------------------------- |
+| Production  | `https://cveawg.mitre.org/api`      |
+| Test        | `https://cveawg-test.mitre.org/api` |
+| Local       | `http://127.0.0.1:3000/api`         |
+
+If you need to connect to a different endpoint, modify the `<select>` element in `index.html` (around line 670).
diff --git a/README.md b/README.md
index 8089e7a..c835fcc 100644
--- a/README.md
+++ b/README.md
@@ -1,86 +1,87 @@
 # cveClient
-A web-based client interface and a client library to cve-services 2.x to provide CVE JSON (5.x) vulnerability management for CVE Numbering Authorities (CNAs) and Roots.
 
+A browser-based CVE management client for [CVE Services 2.x](https://github.com/CVEProject/cve-services) API, built for CVE Numbering Authorities (CNAs) and Roots. Manage CVE records using CVE JSON 5.x directly from your browser — no software to install, no data collected, no backend required.
 
-# Introduction
-A JavaScript library and simple HTML interface for CVE services that is like RedHat's [cvelib](https://github.com/RedHatProductSecurity/cvelib) and [Vulnogram](https://github.com/Vulnogram/Vulnogram).  Provides capabilities to interface with [cve-services](https://github.com/CVEProject/cve-services) with a JavaScript client and simple HTML UI. You can just serve the index.html file from any static content area of your webserver (Apache2, NGINX, thttpd, lighttpd, Caddy).
+**[Live Demo](https://certcc.github.io/cveClient/)** | **[CERT/CC Demo](https://democert.org/cveClient)**
 
-A JavaScript encryption toolkit is also served from [encrypt-storage.js](./encrypt-storage.js) file. This is a simple asymmetric encryption to protect your API Key while in `localStorage` (if <u>*Keep me logged in*</u> checkbox is enabled) or `sessionStorage` with PKI stored in native `indexedDB`. This provides some limited protection of your API keys.  Currently cve-services expects API key for every transaction, there is no middleware providing session capability or related CSRF protection.
+> **Privacy:** This application runs entirely in your browser. It does not store any data on a server, does not track usage, and does not phone home. Your API key is encrypted locally using RSA-OAEP 4096-bit encryption before being stored in browser storage.
 
-Demo of the UI and client library can be accessed at [https://certcc.github.io/cveClient/](https://certcc.github.io/cveClient/) or CERT's [demo site](https://democert.org/cveClient). Currently the allowed servers (cve-services servers) are limited with Content Security Policy headers to cve-services 2.x  production site, testing site and a localhost instance.
+## Compatibility
 
-Dependency libraries for HTML UI only.
-* [jQuery - 3.5.1](https://jquery.com/)
-* [Bootstrap - 4.3.1](https://getbootstrap.com/)
-* [Popper - 1.14.7](https://popper.js.org/)
-* [SweetAlert2 - 2.11](https://sweetalert2.github.io/)
-* [Bootstrap-Table - 1.19.1](https://bootstrap-table.com/)
-* [Ace Editor - 1.2.4](https://ace.c9.io/)
+|                      | Version                                                                                                                    |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| **CVE Services API** | 2.x ([API docs](https://cveawg.mitre.org/api-docs/), [local OpenAPI spec](./api-docs/openapi.json))                        |
+| **CVE JSON Schema**  | 5.x ([schema docs](https://github.com/CVEProject/cve-schema/blob/main/schema/docs/versions.md), [local schema](./schema/)) |
 
-Except for Ace Editor and SweetAlert2 library all the dependencies are served from CDN sources with sha-284 [Subsource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) checks. There is some issue with the nightly builds, so these two libraries are served from local.  Please ensure you understand their license agreements as well.
+### Supported Environments
 
-# Roll out your own using cveClientlib
-If you plan to rollour your own UI, this JavaScript library is helpful.  Also note that there is another client library with similar capabilities built with ECMAScrip6 requirement at [https://github.com/xdrr/cve.js](https://github.com/xdrr/cve.js).
+| Environment | URL                                 | Use Case                    |
+| ----------- | ----------------------------------- | --------------------------- |
+| Production  | `https://cveawg.mitre.org/api`      | Live CVE record management  |
+| Test        | `https://cveawg-test.mitre.org/api` | Testing and training        |
+| Local       | `http://127.0.0.1:3000/api`         | Local CVE Services instance |
 
-You can use the [cveClientlib.js](./cveClientlib.js) to do all the tasks being performed by the current UI. The file is called cveClientlib.js as Safari browsers have trouble with filename and a Class name being the same.
+Select your environment from the dropdown at login.
 
-# Using cveClientlib in Node.js
+## Features
 
-The `cveClientlib.js` file includes conditional exports for Node.js environments. You can use it directly in Node.js scripts (note: `fetch` is available natively in Node 18+):
+- **CVE Record Management** — Create, update, reject, and reserve CVE IDs
+- **Form-Based Editor** — Tabs for Minimal (required fields only), All Fields (full schema), JSON (direct editing with Ace editor), and ADP views
+- **Guided CVE Chatbot** — Step-by-step wizard that walks you through building a CVE record field by field, with CWE autocomplete
+- **AI Review** — Review your CVE record with ChatGPT, Claude, or Gemini before publication. Shows the full prompt for transparency, then copies to clipboard and opens your chosen provider.
+- **User Management** — Create, update, and list users within your CNA organization (admin role required)
+- **Organization Info** — View org details and remaining CVE ID quota
+- **Offline Mode** — Click "Skip" at login to create and edit mock CVE records without connecting to CVE Services, useful for drafting or training
+- **Encrypted Credentials** — API keys are encrypted with RSA-OAEP 4096-bit keys before storage. See [RISKS.md](./RISKS.md) for a full discussion of browser API key security.
 
-```javascript
-const cveClient = require("./cveClientlib.js");
+## Getting Started
 
-const client = new cveClient(
-    "your_org_short_name",
-    "your_username",
-    "your_api_key",
-    "https://cveawg.mitre.org/api"
-);
+### Use the Public Demo
 
-// Get CVE details
-client.getcvedetail("CVE-2024-1234").then(function(cve) {
-    console.log(JSON.stringify(cve, null, 2));
-});
+Visit [https://certcc.github.io/cveClient/](https://certcc.github.io/cveClient/) and log in with your CNA short name, username, and API key. No installation required. The demo connects directly to CVE Services and does not store any data.
 
-// Reserve a CVE ID
-client.reservecve(1).then(function(result) {
-    console.log("Reserved:", result);
-});
+### Run Your Own Instance
 
-// Get org quota
-client.getquota().then(function(quota) {
-    console.log("Quota:", quota);
-});
-```
+cveClient is a static web application — just serve the files from any web server:
 
-For older Node.js versions without native `fetch`, you can use [node-fetch](https://github.com/node-fetch/node-fetch):
+```bash
+git clone https://github.com/CERTCC/cveClient.git
+cd cveClient
 
-```javascript
-const fetch = require("node-fetch");
-globalThis.fetch = fetch;
-const cveClient = require("./cveClientlib.js");
+# Any of these will work:
+python3 -m http.server 8080
+npx serve .
+php -S localhost:8080
 ```
 
-# Running Tests
+Open `http://localhost:8080` and log in. For production deployment with Content-Security-Policy headers, Apache/Nginx configuration examples, and more, see [INSTALL.md](./INSTALL.md).
 
-Tests use [Vitest](https://vitest.dev/) with jsdom and cover pure functions, security regressions, and API client behavior.
+## API Key Security
 
-```bash
-npm ci
-npm test
-```
+Using API keys in a browser carries inherent risks. See [RISKS.md](./RISKS.md) for:
+
+- Why browser-based API key usage is a known risk for CNAs
+- Precautions your organization should take (browser hardening, user audits, key rotation)
+- How cveClient mitigates risk with RSA-OAEP encryption
+- Content-Security-Policy recommendations for self-hosted deployments
+
+## Changelog
+
+See [CHANGELOG.md](./CHANGELOG.md) for the full version history.
 
-Test suites:
-- **Pure function tests** (24 tests) — `get_deep`, `set_deep`, `simpleCopy`, `checkurl`, `check_json`, `queryParser`
-- **Security regression tests** (13 tests) — prototype pollution protection, XSS prevention via `safeHTML` and `cleanHTML`
-- **API client tests** (14 tests) — URL construction, auth headers, CVE/ADP operations
+## Contributing
 
-# Risks of using API keys in browser for CVE-Services
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for architecture details, local development setup, Node.js library usage, running tests, and dependency information.
 
-See the [RISKS.md](./RISKS.md) that captures some of the inherent risks of using API keys to access an API service. If you decide to use these web base clients to access `cve-services`, please be aware of these risks.
+## License
 
+See [LICENSE](./LICENSE) for license information.
 
-# Installation on your own webserver
+---
 
-See the [INSTALL.md](./INSTALL.md), if you would like to run a private version of the cveClient in your own webserver.
\ No newline at end of file
+<p align="center">
+<img src="https://img.shields.io/github/license/CERTCC/cveClient" alt="License" />
+<img src="https://img.shields.io/github/v/release/CERTCC/cveClient" alt="Release" />
+<img src="https://img.shields.io/github/issues/CERTCC/cveClient" alt="Issues" />
+<img src="https://img.shields.io/github/last-commit/CERTCC/cveClient" alt="Last Commit" />
+</p>
diff --git a/RISKS.md b/RISKS.md
index b069d79..c288fb7 100644
--- a/RISKS.md
+++ b/RISKS.md
@@ -1,30 +1,27 @@
-# Risk of using API keys in browser for CVE-Services
-
-
-The [cve-services](https://github.com/CVEProject/cve-services)' API interface is protected by an API key to perform CNA functions to manage CVE records.  An API-key assigned to a user with Admin role (administrator) is also able manage users under their organization.  
-
-Any browser-based client to cve-services requires unencrypted access to the API key to perform each transaction with the cve-services endpoints.  The browser-based clients such as Vulnogram and cveClient depend on the browser to protect these API keys. API key, unlike passwords, are rarely changed and could be stolen from the browser where the API key was entered.  This is a known risk in using browser-based clients when accessing CVE program capabilities as a CNA.  Although there are several technologies such as [ServiceWorkers](https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers) and [Storage APIs](https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html#storage-apis), the browser needs to repeatedly retrieve and use the API keys making this data available in its raw form to support CAN activities. 
-
-If a CNA decides to use these clients, they should be aware of the risks that the API key could be stolen from the browser. The CNA should take necessary precautions as appropriate for their organization to protect the API keys.  
-
-If a CNA chooses to use this or other web based interfaces to access the cve-services, here are some precautionary measures the CNA may adapt to reduce risk of abuse of their cve-services credentials. 
-* Secure the browser. 
-Ensure the organization’s computer and browser software are well-managed and kept up to date with security updates. Limit the browser plugins to ensure secure and audited plugins are installed on the browser. Use automatic updates and timely restart of the browser to reduce long-running unpatched software.
-* Audit and manage users.  
-Organization audits and verifies the users who belong to their organization and timely disables the users who have left the organization or have no longer need the role to manage CVE records for the organization. 
-* Regenerate your API keys periodically. 
-The cve-program allows for regeneration of the API keys for users in an organization. This is recommended to match the organization password and API credentials lifecycle management policy.  This can also allow for timely auditing and detection of rogue users and stray accounts that are part of your organization
-* Protect web server, if you run your own.
-The software Vulnogram can be accessed at [https://vulnogram.github.io](https://vulnogram.github.io) for a client only solution from GitHub site. Similarly cveClient is also accessible from [https://certcc.github.io/cveClient/](https://certcc.github.io/cveClient/).  These are static websites hosted at GitHub and do not collect any information from your browser but only serve static web content. However, if you wish to run a cloned or forked version of Vulnogram or cveClient software from GitHub, ensure your publishing web server is protected from Cross-Site Scripting (XSS) attacks using something like [Content-Security-Policy headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).
-
+# Risk of Using API Keys in Browser for CVE Services
 
+The [CVE Services](https://github.com/CVEProject/cve-services) API interface is protected by an API key to perform CNA functions to manage CVE records. An API key assigned to a user with the Admin role is also able to manage users under their organization.
 
+Any browser-based client to CVE Services requires unencrypted access to the API key to perform each transaction with the CVE Services endpoints. Browser-based clients such as Vulnogram and cveClient depend on the browser to protect these API keys. API keys, unlike passwords, are rarely changed and could be stolen from the browser where the API key was entered. This is a known risk in using browser-based clients when accessing CVE program capabilities as a CNA. Although there are several technologies such as [Service Workers](https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers) and [Storage APIs](https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html#storage-apis), the browser needs to repeatedly retrieve and use the API keys making this data available in its raw form to support CNA activities.
 
+If a CNA decides to use these clients, they should be aware of the risks that the API key could be stolen from the browser. The CNA should take necessary precautions as appropriate for their organization to protect the API keys.
 
+## Precautions
 
+If a CNA chooses to use this or other web-based interfaces to access CVE Services, here are some precautionary measures the CNA may adopt to reduce risk of abuse of their CVE Services credentials:
 
+- **Secure the browser.**
+  Ensure the organization's computer and browser software are well-managed and kept up to date with security updates. Limit browser plugins to ensure only secure and audited plugins are installed. Use automatic updates and timely restart of the browser to reduce long-running unpatched software.
 
+- **Audit and manage users.**
+  Audit and verify the users who belong to your organization. Timely disable users who have left the organization or no longer need the role to manage CVE records.
 
+- **Regenerate your API keys periodically.**
+  The CVE program allows for regeneration of API keys for users in an organization. This is recommended to match the organization's password and API credentials lifecycle management policy. This also allows for timely auditing and detection of rogue users and stray accounts.
 
+- **Protect your web server, if you run your own.**
+  The software can be accessed at [https://certcc.github.io/cveClient/](https://certcc.github.io/cveClient/) — a static website hosted on GitHub that does not collect any information from your browser. However, if you wish to run a cloned or forked version from GitHub, ensure your publishing web server is protected from Cross-Site Scripting (XSS) attacks using [Content-Security-Policy headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy). See [INSTALL.md](./INSTALL.md) for recommended CSP configuration.
 
+## How cveClient Mitigates Risk
 
+cveClient includes an encryption layer ([`encrypt-storage.js`](./encrypt-storage.js)) that provides RSA-OAEP 4096-bit asymmetric encryption of API keys before storing them in `localStorage` or `sessionStorage`. The encryption keys are persisted in the browser's native `indexedDB`. While this does not eliminate all risk (the key must be decrypted for each API call), it provides protection against casual inspection of browser storage.