Security
How values are stored, read, and logged.
Encrypted on its own. Opened by one token for one environment. Read into a log that names keys and never values.
Encrypted one value at a time.
Nine rules cover how a value is stored, who can read it, and what the log keeps. Open any one to see how it works.
Encryption per value
Each value gets its own AES-256-GCM ciphertext.
Two values in the same environment never share a ciphertext, so one exposure stays one value.
One data key per project
Values in a project are encrypted under that project's own data key.
The data key is stored wrapped by a root key. The root key exists only as a Worker secret, never in the database.
Context binding
A ciphertext only decrypts in its own project, environment, and variable name.
Those three names are bound into the encryption as associated data. Moved anywhere else, the ciphertext fails to decrypt.
Key rotation
Rotate the root key without touching a single value.
Rotation rewraps each project's data key. The encrypted values stay where they are.
Scoped tokens that expire
A token opens one project and one environment, then expires.
There is no token without a scope and an expiry. An expired token resolves nothing.
Tokens stored as digests
The raw token is shown once, when you create it.
The database stores only its digest. Nobody, including us, can read a token back.
Withheld values
Mark a value withheld for an agent and it is left out of that agent's environment.
A withheld value is not sent to the client at all. The command runs without it.
Audit records name keys, not values
Every read records who read, the project, environment, key names, source, and time.
Values never enter the audit record, so the log can be kept for as long as you need it.
Encrypted local cache
The CLI keeps the last resolution encrypted on disk for five minutes.
A network blip inside that window does not stop your command. After five minutes the cache expires and the CLI resolves again.
One-time shares
Send a value to someone without an account. The link closes on first read, or at a deadline you set.
Two-factor for everyone
Require an authenticator app for the whole organization. A member without one cannot get in.