All Releases
Wheelder Safety Platform v1.0 — Universal Credential Rotation Agent
By Abdul Baays Fakhri
A consumer-grade, human-in-the-loop credential rotation agent — the foundation of privacy and online safety in the age of AI. Works with any credential manager or without one.
Overview
Wheelder Safety Platform is a consumer-grade, human-in-the-loop credential rotation agent — the foundation of privacy and online safety in the age of AI. It is designed for individuals and teams who want full control over their digital credentials without relying on third-party automation services.
The platform accepts a CSV export from any credential manager, generates strong new credentials, navigates to each service via a Playwright browser session, applies the update with human confirmation, and produces an updated CSV ready for re-import. No credentials are written to the database at any point — only account metadata is stored.
| Version | v1.0 |
| Release Date | March 2026 |
| Status | Public Demo |
| Live Demo | wheelder.com/safety |
| Repository | github.com/Wheelder/Wheelder_Safety_Platform |
| Code Snapshot | wheelder.com/safety/snapshot |
| Release Note PDF | Download PDF |
What Is New in v1.0
- Universal CSV Workflow — Import accounts from any credential manager export (Bitwarden, LastPass, Dashlane, Chrome, Safari) or add them manually. Generate updated credentials and export a refreshed CSV for re-import — no vendor dependency.
- Bulk Rotation Tab — Step-by-step workflow: Import → Generate → Rotate → Export. Each stage unlocks only after the preceding step completes, preventing unintended partial runs.
- Human-in-the-Loop Agent — A Playwright-powered browser session navigates to each service and applies the new credential. The user reviews and confirms each change before it is committed.
- DEMO Mode — The public demo includes pre-populated sample accounts across ten services. Visitors can explore every workflow without connecting real credentials.
- Code Snapshot — A public API surface summary is published at wheelder.com/safety/snapshot, enabling transparent review of method signatures without exposing implementation details.
- Zero Credential Storage — Credentials flow through subprocess memory only and are never persisted to the database. Python bytearray objects are used instead of immutable strings and are explicitly cleared after each rotation task completes.
- Subprocess Isolation — Each rotation job runs in its own OS process. When the process exits, the operating system reclaims all memory, eliminating residual credential exposure between jobs.
- Audit Trail — Every rotation attempt is logged with a timestamp, duration, outcome, and descriptive message. Full history for each account is accessible from the dashboard in one click.
Application Screenshots — DEMO
Fig 1 — Managed Accounts: 10 sample accounts across major services, all in Idle state
Additional views available in the full release note PDF (4 pages, includes Bulk Rotation tab, Add Account dialog, and Settings panel).
Security Design
| Control | Implementation |
|---|---|
| No credentials in database | Only account metadata (name, URL, username) persisted |
| Memory protection | Python bytearray with explicit clearing after use |
| Process isolation | Each job in a separate subprocess; OS reclaims memory on exit |
| Input validation | All account IDs validated as integers; site types allowlisted |
| No shell execution | PHP proc_open() and Python subprocess.run(shell=False) throughout |
| Prepared statements | All database writes use PDO prepared statements |
System Requirements
- PHP 7.4+ with SQLite3 extension
- Python 3.10 or later
- Browser automation — Playwright for Python + Chromium
- Database — SQLite 3 (embedded — no separate server required)
- Credential manager — Any (CSV export/import) or none
Images