MAERMIN is a fully client-side investment tracker that runs in your browser with no installation. All data is stored in your browser's localStorage — it never leaves your device. Access is protected by an encrypted vault: an access password derives an AES-256-GCM key (PBKDF2-600k, or Argon2id when available) via crypto-vault.js; the password is never stored, and sensitive data can be encrypted at rest. Optional passkey unlock (WebAuthn) and an idle auto-lock are built in.

Built with React (via CDN) and vanilla JavaScript. No build step required for development, no framework to install. Works offline after the first load (PWA). A local audit log records security events and uncaught errors on-device.

No account  ·  No server  ·  No ads  ·  No remote telemetry  ·  MIT License

Privacy note: there is no remote telemetry. The on-device "Security log" (Settings → Security log) stays in your browser and is never transmitted.

https://maermin.github.io/MAERMIN/

On first run you set your own access password (no shipped default) and are handed a one-time recovery code — download or print it. It's an alternative way to unlock the vault if you forget your password, stored only as a wrapped key (never in readable form, never transmitted). The first run also opens a guided setup wizard (below); you can re-open it anytime from API Settings → Guided setup, or pick Demo mode to explore a sample portfolio before any setup.

The Worker is required for stock prices, historical chart data, CS2 prices, and symbol search. It's free and takes ~2 minutes. The in-app guided setup wizard walks you through this with a one-click Copy worker.js and a live connection test that pings each data source and shows green/red per endpoint.

1. Go to dash.cloudflare.com → Workers & Pages → Create Worker
2. Paste the contents of cf-worker/worker.js
3. Save and Deploy — copy the Worker URL
4. Paste URL in MAERMIN → API Settings → Cloudflare Worker (or let the wizard test + save it)

Add a free Alpha Vantage key in API Settings as a fallback for stocks when Yahoo Finance returns no data. Free tier: 25 requests/day.

All endpoints are rate-limited (per-IP) and use hard fetch timeouts. Full request/response contracts: docs/WORKER.md.

MAERMIN/
├── index.html                  Entry point — loads all scripts in order, sets CSP
├── styles.css                  App styles
├── audit-log.js                Security/error audit trail (window.MaerminAuditLog)
├── crypto-vault.js             AES-256-GCM vault, KDF, passkeys (window.MaerminVault)
├── storage.js                  Encrypted-at-rest storage shim + backups (window.MaerminStorage)
├── migrations.js               localStorage schema migrations (window.MaerminMigrations)
├── auth.js                     Vault unlock/setup gate (window.MaerminAuth)
├── utils.js                    Shared formatters, upsertTransaction, FX (window.MaerminUtils)
├── metrics.js                  Shared metrics: positions, net worth, FIRE (window.MaerminMetrics)
├── portfolio-intelligence.js   Ten-check structural problem detection, ranked (window.MaerminIntelligence)
├── ticker-validation.js        Symbol normalisation (window.MaerminTickers)
├── equity-metadata.js          Sector/country metadata (window.MaerminEquityMeta)
├── dividend-data-service.js    Dividend data + forecast (window.DividendDataService)
├── tax-report-builder.js       Filing-grade tax report + PDF/Excel (window.MaerminTaxReport)
├── allocation.js · projection.js · recurring.js   Allocation / forecast / liabilities engines
├── renderer.js                 Main React app — state, routing, transactions (~3,800 lines)
├── features.js … features7.js  Feature views (charts, analysis, dividends, net worth, …)
├── build.mjs                   Web build — bundles + minifies (reads index.html order)
├── test/                       Node test harnesses (npm test)
├── docs/                       ARCHITECTURE.md · WORKER.md
└── cf-worker/worker.js         Cloudflare Worker — market-data proxy, sync, broker relay

Full module/view map and data flow: docs/ARCHITECTURE.md.

The app runs directly from index.html (no build needed for dev). Common scripts:

npm install        # once, pulls esbuild (web build) + electron (desktop)
npm test           # run all Node test harnesses (test/*.test.js)
npm run check      # syntax-check every JS file (fast pre-commit gate)
npm run build:web  # -> dist/index.html + dist/maermin.min.js + dist/styles.css

Contributing guidelines and conventions: CONTRIBUTING.md.

• All data stored in localStorage — never transmitted anywhere
• Encrypted vault: AES-256-GCM with PBKDF2-600k (or Argon2id); password never stored; optional encryption at rest, passkey unlock, idle auto-lock
• Recovery code: a one-time code generated at setup is an alternative way to unlock the vault if you forget your password — implemented as a second key-wrapping (like a passkey), never stored in readable form and never transmitted, so the zero-knowledge model is preserved. Changing your password invalidates it; generate a fresh one afterwards.
• Encrypted backups: export a portable, password-protected backup (Settings → Backup vault) — a portable recovery path you can store off-device
• On-device audit log: security events + uncaught errors (Settings → Security log), never transmitted
• No analytics, no remote telemetry, no third-party tracking
• API calls go to: CoinGecko, ExchangeRate-API, your own Cloudflare Worker
• Your Worker only relays to Yahoo Finance / Steam / (optionally) whitelisted exchanges — no data is stored except the opt-in zero-knowledge sync blob
• Set or change the access password in-app (Settings → Change Password) — no code edits needed

See RELEASE.md for full release notes.

MIT — see LICENSE