Experimental developer tool
Run your app without plaintext .env files.
Store development secrets encrypted and inject them when you run a command. Keep credentials out of project files and routine copy-paste workflows.
Under development. An agent controlling the running process can still read its injected secrets. Not ready for valuable production secrets. There is no public sign-up yet; Local Mode runs the same loop on your machine with no account.
$ insecur init
$ insecur secrets set SESSION_SIGNING_KEY --generate
$ insecur run --variable-key SESSION_SIGNING_KEY -- npm start
What you get
What the development workflow does.
Encrypted storage
Store development secrets encrypted.
Import the values your project needs, then remove the original plaintext file when you're ready. Local Mode keeps an encrypted store on your machine; hosted mode stores values remotely.
Runtime injection
Load secrets when your command starts.
Run your app through insecur. It injects the selected values into the child process environment, so you don't have to paste them into a project file for each run.
Recorded access
Review recorded secret use.
The hosted audit trail records secret grants and use. It helps you review access through insecur, but it cannot detect every read or leak inside the running process.
Where we want to go
An agent read a secret. Replacing it should be easy.
The goal is one-button recovery after an accidental exposure: replace the credential, update where it is used, and revoke the old one. Automatic rotation is not available today. Changing a value stored in insecur does not revoke it at its provider.
Read the docs