What this is, and how to read it
Handbook
Every team has passwords, API keys, and database credentials that a few people and a few machines need, and that nobody else should ever see. This is a guide to why that is hard, and how this tool makes it manageable. It assumes you know nothing about cryptography.
About this document
This describes version 1 of the tool as designed. Features that arrive after the first release are marked with a badge like this (later phase) so you always know what you can use today.
What this is
A secrets manager: a shared, encrypted place to keep credentials, plus the commands to put things in, take things out, and decide who is allowed to.
Two things make this one unusual, and both are worth understanding before you start:
- Your secrets are encrypted before they leave your computer. Not encrypted by a server on your behalf. Encrypted by you, on your machine, with a key the server never sees. Everything else follows from this one decision.
- You can run it with no server at all. The storage is an ordinary git repository full of encrypted files. A server is optional, adds useful things, and can be switched on or off later without re-encrypting anything.
How to read this
| If you are… | Read |
|---|---|
| New to all of this | Everything, in order. It builds up. |
| A developer who just needs a password | Part 3 · Day to day, then come back to Part 1 when something confuses you. |
| Setting this up for a team | Part 2 and Part 4, then Part 5 before you promise anyone anything. |
| A security reviewer | the powerless-server bet, asserted vs attested, and all of Part 5. The design document in docs/PRD_v2.md has the full threat model. |