Apocrypha
Your .env files, sealed in your browser before they leave it.
Keep the environment variables for every project in one place, share them with the people in your org, and pick them up on any machine. Our server stores ciphertext and can't read it.
Early development. The crypto is unaudited.
The same three secrets, as you see them and as we store them. Names are sealed along with the values.
What the server holds
sample valuesIn your browser
On our server
DATABASE_URL=postgres://app:hunter2@db.internal/prod
v1|a256gcm|Qm9Kc2xhYmVsVnU3
v1|a256gcm|7fT0xk2LwQ-aP9dRz1Vn
STRIPE_SECRET_KEY=sk_live_example_not_a_real_key
v1|a256gcm|H3dsYzQ0eHBvcnRfZ2
v1|a256gcm|c0Gm4Jb8Yw_u2NhK6tSe
SENTRY_DSN=https://abc123@o0.ingest.sentry.io/1
v1|a256gcm|Zk5hdHRlcnNlbnRyeQ
v1|a256gcm|Rr1pXo7Vd3-LqA0yT8uC
Stored in the clear: the names of your orgs, projects and environments, who belongs to each org and in what role, when each change happened and who made it, and how many secrets an environment holds. Never stored: your passphrase or your private key.
The design
Sign in
GitHub, Google or an email link. That proves to the server who you are, and nothing more.
Identity
> sign in with github
your browserour serverserver learns who you are
server learns nothing about what you hold
vault: not made yet
Make a vault
Choose a passphrase. Your browser turns it into a key that locks your private key, and hands you a recovery key once. Save it.
Vault
passphrase ••••••••••••••
argon2id 64 MiB, t=3, in this browser
locks your private key
server keeps: v1|a256gcm|Qm9Kc2xhYmVs…
recovery key shown once. Save it.
One key per environment
dev, staging and prod each have their own key, and only people you grant can read it. A role is enforced by the cryptography, not only by a check on our server.
Keys
member dev key v1 staging key v1 prod key v1 you write write write ana write read none ben read none none read means holding the key. The cryptography enforces it.
Invite by link
The key for a new teammate travels after the # in the link. Browsers never send that part to us.
Invite
https://apocrypha.example/join/9f3a1c#k3Wm9Qx7LpA2dRv8TnYe
your browser sends GET /join/9f3a1c
server
after the # never leaves your browser
not sent
That part holds the key. We never see it.
Identity
1 of 4> sign in with github
server learns who you are
server learns nothing about what you hold
vault: not made yet
Limits, up front
read before you trust itUnaudited.
The crypto has tests and published vectors but no independent review yet. Don't store anything you can't rotate.
We serve the code that decrypts.
A compromised server could ship a page that steals your passphrase. A strict CSP and open source shrink that risk. They don't remove it.
Removing someone doesn't make them forget.
Rotate the secrets themselves at their source. We'll list which ones the person could read.
Lose the passphrase and the recovery key, lose the data.
Nobody can recover a personal vault for you, including us.
Make a vault
Sign in, choose a passphrase, and seal your first .env. Everything you store after that is encrypted before it leaves this browser.
Early development. The crypto is unaudited, so don't store anything you can't rotate.