Writing
Secrets, environments, and the parts nobody writes down.
Everything we have learned building a secret manager, written for the engineer who has to make the call on a Friday afternoon. No gated PDFs, no lead magnets.
More posts
Next.js environment variables: what NEXT_PUBLIC_ really does, and the three ways secrets end up in the browser bundle
The inlining model for the App Router: build time versus runtime, which .env file wins, the server-only boundary, and how to grep what actually shipped.
Read the postThere is an API key in your git history. Here is how to find it, and what to do in the ninety minutes after you do.
A key deleted in a later commit is still live and still readable. How to find secrets in git history, plus the rotate-first runbook that keeps production up.
Read the postYour CI pipeline is the softest target you own: a practical guide to secrets in CI/CD
CI holds production credentials, runs code from pull requests, and writes logs half the company can read. The failure modes that leak secrets, and the fixes.
Read the postEnvelope encryption, zero-knowledge, or plain trust: how to read a secret manager's security page
Every secret manager encrypts your data. Only some cannot read it. How envelope encryption works, what zero-knowledge really costs, and the questions to ask.
Read the postHow to rotate a secret without taking production down
Rotation is avoided because it is a distributed change, not a hard one. The overlap pattern, finding every consumer first, and what to do without overlap.
Read the postRead the docs, or just try it.
Every post here describes something the product does. The quickstart takes about a minute, and the free tier does not ask for a card.
No credit card · AGPL-3.0 server · MIT CLI · Self-host it for free