Environment Vault
Stop pasting .env files into chat
Secrets live with the repository, encrypted, per-environment, and audited. Developers pull them with one command; everyone else never needs to see a value at all.
What the Vault does
Secrets management that behaves like part of the repository, not a separate product bolted alongside it.
Envelope encryption
Each secret is encrypted with AES-256-GCM under a data key, which is itself encrypted by a cloud KMS-backed master key. Plaintext exists only inside the vault package's decrypt paths.
Per-environment secrets
Separate values for Development, Preview, Production — or any environments you define. Free includes 4 environments per repository; paid plans are unlimited.
Roles, grants, and expiry
Access follows workspace roles. Reveals are permissioned, and access grants can expire — a contractor's access ends when the engagement does.
Audit trail
Every read, reveal, and change is recorded: who, what, when. Retention scales with your plan.
Masked by default
The UI shows masked values (sk_l····7dc). Revealing requires permission and is itself an audited event.
.env.example generation
Generate a committed .env.example from the Vault's keys so new teammates always know which variables the project needs — without ever committing values.
A CLI flow developers actually keep using
Log in once, pull the environment you're allowed to read, and run your dev server with secrets injected — nothing written to disk unless you ask. Setting a value from the terminal updates the same encrypted store the web UI shows.
Shell
keelson login
keelson vault pull
keelson vault run npm run dev
keelson vault set STRIPE_SECRET_KEYHow a value is protected
Each secret is wrapped twice: the value under an AES-256-GCM data key, and that data key under a cloud KMS-backed master key. Plaintext exists only inside the vault package's decrypt paths.
The Vault is included on every plan — including self-hosted.
Customer-managed keys are on the Enterprise track.