FutsuBetaPlaintext never touches disk.
Ciphertext at rest under AES-256-GCM, scoped to a user or a whole workspace — plaintext exists only in memory, hydrated per run.
AES at rest, hydrated at runtime.
The app runs on your machine, and secrets live as AES-GCM ciphertext in its local database. The master key comes from the environment — not from a file beside the data — and decryption happens in memory, only when a run needs a key. That holds offline too: no network call sits between you and your own secrets.
- AES-256-GCM encryption at rest
- Master key from the environment — never beside the data
- Hydrated in-memory per run
User and workspace scopes.
Keep personal tokens to yourself and share provider keys across a workspace. Scan a repo for leaked secrets and import them straight into the vault.
- Per-user and per-workspace secrets
- Scan code for live secrets
- Import-from-code in one click
What teams use Vault for.
Share provider keys across the team safely
Workspace-scoped secrets decrypt per run; plaintext never lands on disk.
Keep personal tokens out of workspace scope
User-scoped entries stay yours, even on shared canvases.
Catch live secrets before they ship
Scan the repo, find real keys, import them into ciphertext in one click.
Secrets, handled the boring-safe way.
Ciphertext at rest, scoped to you — plaintext only in memory.