Security
Built so a leak yields nothing but ciphertext.
Security isn't a feature bolted on after the fact — it's the architecture. Secret values are sealed before they reach the database, resolved only in memory at runtime, and guarded by least-privilege access and a full audit trail.
Secrets never touch disk
Values are resolved in memory and never written to disk, logs, or env files by Vaultlier. Generated files contain metadata only.
Envelope encryption
AES-256-GCM with a per-project key derived via HKDF from a server-side master key. The database only ever sees ciphertext, nonce, and auth tag.
Server-side master key
VAULT_MASTER_KEY lives only in the server environment — never in the browser. It's validated at startup so a misconfigured deploy fails fast.
Zero runtime dependencies
The vaultlier package ships with no third-party dependencies — nothing to install beneath it, so the supply-chain attack surface is effectively nil.
Least-privilege access
Role-based: viewers read, members write. Account tokens manage projects but can never read secrets. API keys are scoped to one project.
Audited mutations
Every change is recorded and versioned. The activity log surfaces who wrote or deleted what, while routine reads stay out of the way.
Hashed credentials
API keys are stored as a SHA-256 hash plus a display prefix. The raw key is shown once and is never retrievable afterward.
Clear trust boundaries
The dev inspector binds to loopback and only ever surfaces dev values. Device login requires browser approval for each CLI session.
The core guarantee
Vaultlier encrypts every value with a per-project key before it is stored, and decrypts only in the running process that needs it. The master key stays server-side and is never exposed to the browser. A database or storage-bucket compromise reveals opaque bytes — not your secrets. Full details, including the trust boundaries and a production checklist, live in the docs.