About xecret
We built the secret manager we wanted to be able to audit.
xecret is open-source secret management from Playxoft, and it is pre-alpha. The server is AGPL-3.0, the CLI is MIT, and the trust model is a document you can read before you trust a line of it.
Why we built it
Secret management split into two camps, and most teams live in the worse one.
Not because they do not know better — every engineer who has pasted a production key into a direct message knew exactly what they were doing as they did it — but because the first camp costs more than the problem appears to, right up until the week it does not.
Camp one
Cloud KMS and IAM
Correct, thorough and shaped like infrastructure. Nothing about it is wrong; it is arranged for the person who owns the cloud account rather than for the person who needs one value.
- Time to a working database URL
- An afternoon.
- What it costs you
- An IAM policy and a resource identifier, written before anybody is unblocked.
Camp two
A .env file in a Slack thread
It works in about four seconds, and that is the entire reason it wins. Most teams live here.
- Time to a working database URL
- About four seconds.
- What it costs you
- A production key in a direct message, and no record of who has read it.
A tool only wins if it is easier than the habit it is replacing.
What xecret is
An attempt at the middle, shaped like a developer tool: one command to log in, one command to run your application, an offline cache so a flaky connection does not stop your dev server, and an importer that takes the .env file you already have. And it keeps the one thing that file can never keep — an append-only record of who read which value, in which environment, and when.
And what the middle costs
It is built by Playxoft, a small software company, and the middle ground has a price. xecret decrypts on the server, which means we can technically read your secrets. That is the trade that makes team sharing, CI tokens and browser-side import work without a key-exchange ceremony, and it is the first thing we would want to know about a company holding our credentials.
What we believe
Six commitments, each with the thing it costs us.
A principle you can hold a company to is one that could be broken visibly. These can be, which is why the price of each is printed underneath it.
We describe the trust model as it is
xecret decrypts on the server. Every environment has its own data key, encrypted under a root key we hold, and every decryption lands in an append-only log. So we can technically read your secrets, and we say that before you migrate rather than after.
What it costs us
The vaguer sentence sells better. "Zero-knowledge" converts; "we hold a root key" does not. We will not print the first one, because it is not true of us.
The source is readable before you trust it
The server is AGPL-3.0 and the CLI is MIT. The cryptography you are relying on, the schema your secrets sit in and the handler that decrypts them are all in one public repository, next to the threat model.
What it costs us
An MIT CLI can be shipped inside a competing product, and an AGPL server can be read by anyone deciding to build one. That is the trade for a binary your legal team can clear in an afternoon.
Self-hosting is a path, not a punishment
The self-hosted server is the same server, with no feature held back and no licence key gating a build you compiled yourself. The guide states the real dependency list, including the parts that are friction.
What it costs us
Every self-hosted install is a team we never bill. We would rather have the install and the scrutiny that comes with it.
Colour means status and nothing else
Production is marked with a reserved colour, an uppercase label and hazard hatching, all three at once, so the marking survives colour blindness, a greyscale print-out and a failing monitor. Nothing else in the product is allowed to borrow that colour.
What it costs us
It rules out most of the tricks a marketing site uses to look lively — no gradient headings, no colour-coded feature cards, no accent that means "click me". A mislabelled production environment costs an outage; a plain-looking page costs nothing.
Documentation is written for the 2am reader
The person opening our docs is usually mid-incident, on a phone, looking for one command. So pages lead with the command and explain afterwards, and the failure modes are written down beside the happy path.
What it costs us
Documentation aimed at somebody who is already in trouble is longer, blunter and far less quotable than documentation aimed at somebody still evaluating us.
No dark patterns in the billing
Prices are on the pricing page in numbers. There is no trial that quietly becomes a subscription, no card taken for a free tier, and cancelling is a button rather than a conversation with support.
What it costs us
The quiet auto-conversion is the single most effective growth mechanism in this category, and we have given it up.
Where we are
Pre-alpha, and here is exactly what that covers.
Shipped, in progress, next. Nothing on this board is dated, because a date we cannot support is worse than no date at all.
Shipped
In the product today.
Organisations, projects and environments
The hierarchy the dashboard is built on. Each environment is given its own data key at the moment it is created, and production carries a reserved colour, an uppercase label and hazard hatching so it cannot be confused with staging at a glance.
Members, invites and service tokens
Bring a teammate in by email address; issue a token for a CI job. Both are revocable from the dashboard, and both leave a trail behind them.
An append-only audit log
Every decryption is written down, including the ones the server performs on your behalf. This is the feature the rest of the product is arranged around — encryption is the easy half.
The CLI, with an offline cache
xecret login, then xecret run -- npm run dev. The cache means a dropped connection does not stop your dev server. Framework guides are written for Next.js, Node, React and Vite, Go, Docker and CI.
Browser-side .env import
The file you already have is parsed in your tab rather than uploaded, so a pasted blob of production credentials never becomes a request body.
A self-hosting guide that states the real cost
Cloudflare Workers, a PostgreSQL database and your own WorkOS account for sign-in, written out with the parts that are friction left in. An open-source secrets manager that hides its operational cost is not being honest about the one thing it sells.
In progress
Being written now.
Documentation written in the open
The docs tree lives in the repository and ships with the application, so a guide and the code it describes move in the same commit. Pages land as they are written rather than in a launch bundle.
Hardening before the label changes
Key rotation and the recovery ceremony rehearsed rather than merely documented, and the threat model kept level with the code instead of a release behind it. This work is what decides when pre-alpha ends.
Next
Named, and not built.
SSO and provisioning
SAML single sign-on is named on the pricing page as a per-connection add-on from Team, and as included with Enterprise. SCIM provisioning is included with Enterprise and not sold below it. Neither is built, and the comparison table says so in the row rather than in a footnote under it. Roles and per-environment access are built already — those are a plan boundary, not a promise.
Billing, switched on
No card is collected anywhere yet, and each plan’s limits apply now, exactly as the pricing page states them. Nothing will start charging without our saying so first, and nobody will find out from an invoice.
Pre-alpha means the API can still move underneath you and a migration can still be disruptive. What changed and why goes up on the xecret blog as it happens, rather than being collected into a launch post afterwards.
The stack, and why
Four decisions you inherit if you self-host.
Every one of these has a cost attached. They are stated here rather than discovered halfway through a setup guide.
Cloudflare Workers
RuntimeThe API runs at the edge, so the CLI is not waiting on a round trip to a single region before your dev server starts. The trade-off is a runtime that is not Node: no native modules, a hard CPU budget per request, and a shorter list of libraries that work.
PostgreSQL — Neon, or vanilla
DataBoring on purpose. Neon backs the hosted service and a plain PostgreSQL server backs a self-hosted one, on the same schema either way. Self-hosting is not a second implementation that quietly falls behind the first.
WorkOS for identity
IdentitySign-in, password reset and email verification are solved problems with a long tail of abuse cases, and we would rather trust an implementation that has already met them all. WorkOS AuthKit checks who you are and sees your email address, your name and your sign-in events — never a secret — and xecret then issues its own session, which you can list and revoke. The cost is honest: a self-hosted install needs its own WorkOS account.
A Go CLI
ClientOne static binary and no runtime to install, which is what lets it drop into a scratch Docker image or a CI runner without dragging a Node installation in behind it. MIT, so the thing inside your pipeline carries a licence nobody has to argue about.
Questions
The questions we would ask a company holding our credentials.
Who is behind xecret?
Playxoft, a small software company. There is no funding announcement to point at and no customer logos to show you. What there is, is a public repository, two real licences, a written threat model and a self-hosting guide — all of which you can read before you trust any of it.
Is xecret really open source, or is it open core?
Really open source. The server is AGPL-3.0 and the CLI is MIT, and a self-hosted install gets the whole server with no feature held back — no enterprise-only build, no licence key gating a capability inside a binary you compiled yourself. What we sell is the hosted service and, for organisations that want one, a support contract.
What happens to my secrets if Playxoft disappears?
The software outlives the company. The server is AGPL-3.0 and self-hosting is a documented path — Cloudflare Workers, a PostgreSQL database and your own WorkOS account — so an instance can be stood up without us. Your values also come back out as the .env file they went in as, which means the exit path is a file format you already know how to use.
Can you read my secrets?
Technically, yes. xecret uses server-side envelope encryption: every environment has its own data key, itself encrypted under a root key we hold, and values are decrypted inside a single request handler with every decryption written to an append-only audit log. It is the same model Doppler uses, and it is what makes team sharing, CI tokens and browser-side .env import work without a key-exchange ceremony. If you need a provider that cannot read your secrets even in principle, you need a zero-knowledge product, and we would rather you knew that now than after migrating.
How do you make money?
From the hosted service. Free is $0 forever for 1 organisation, 5 projects, 3 members, 3 environments per project and 7 days of audit history. Pro will be $5 per member per month billed yearly, or $8 month to month, for 3 organisations, 25 projects, 10 environments per project, unlimited members and 30 days of history. Team will be $12 billed yearly, or $19 month to month, for 10 organisations, 100 projects, 25 environments per project, 180 days of history, roles and per-environment access, and priority support. Enterprise is custom, dropping the ceilings, for a year of audit history, a self-hosting support contract and an SLA — SAML single sign-on is a $199 per connection per month add-on from Team, and is included with Enterprise; directory sync (SCIM) is included with Enterprise and not sold below it. Neither is built yet. Self-hosting is free, always. While xecret is in pre-alpha no card is collected, and each plan’s limits apply now.
Is xecret production-ready?
No. It is pre-alpha. The API can still change under you, a migration can still be disruptive, and there is no uptime commitment to point at. Use it on side projects and internal tools, tell us what breaks, and wait for the label to change before you put your production database credentials behind it.
Questions about the CLI, CI, migrating off a .env file and the plans are answered on the full FAQ.
Read the source before you trust the product.
The server is AGPL-3.0 and the CLI is MIT, so nothing on this page has to be taken on faith. Clone it, read the threat model, then create a free project and import the .env file you already have.
No credit card · AGPL-3.0 server · MIT CLI · Self-host it for free