# insecur

> An experimental developer tool for encrypted development secrets and runtime injection.
> Run your app without plaintext .env files. An agent controlling the running process
> can still read injected secrets. Automatic rotation is not available. There is no public
> sign-up yet; Local Mode needs no account. Not approved for valuable production secrets.

Every documentation page is served two ways: rendered HTML at the listed URL without the
`.md` suffix, and raw markdown at the `.md` URL. The CLI reports secret metadata;
a child process can still print values it receives. Commands support `--json` and stable exit codes.

For project adoption, start with the [agent quickstart](https://insecur.cloud/docs/agent-quickstart.md).
It covers Local Mode setup, the intended credential, normal commands, and fresh worktree verification.

## Getting started

- [Documentation](https://insecur.cloud/docs/index.md): Try insecur as an experimental tool for encrypted development secrets and runtime injection.
- [Quickstart](https://insecur.cloud/docs/quickstart.md): Install the CLI, store a secret, and run a command with it injected, in about five minutes.
- [Installation](https://insecur.cloud/docs/installation.md): Install the insecur CLI on macOS, Linux, or Windows with verified binaries.
- [Agent quickstart](https://insecur.cloud/docs/agent-quickstart.md): Adopt insecur in an existing project and verify its intended development credential in a fresh Git worktree.

## Concepts

- [How insecur works](https://insecur.cloud/docs/how-it-works.md): How encrypted development storage and runtime injection work today, plus the prelaunch production design.
- [Core concepts](https://insecur.cloud/docs/concepts.md): The domain vocabulary, organizations, projects, environments, secrets, grants, policies, and how the pieces relate.
- [Security model](https://insecur.cloud/docs/security-model.md): Current development boundaries, the prelaunch protected-environment design, and what is out of scope.

## Guides

- [Using insecur with coding agents](https://insecur.cloud/docs/agents.md): Keep plaintext secrets out of project files and attribute runtime injection to coding-agent sessions.
- [Running commands with secrets](https://insecur.cloud/docs/run.md): Inject encrypted development secrets into a child process with a fresh one-use grant.
- [Migrating from .env files](https://insecur.cloud/docs/migrate-dotenv.md): Move secrets out of a plaintext dotenv file into custody, verify, then remove the file.
- [Scanning for exposed secrets](https://insecur.cloud/docs/scan.md): Find likely plaintext secrets in your project, home directory, and agent transcripts, without printing values.
- [Local Mode](https://insecur.cloud/docs/local-mode.md): Run insecur accountless with an encrypted machine-local store, then move to hosted custody later.
- [Audit and verification](https://insecur.cloud/docs/audit.md): Read the metadata-only audit feed and verify tamper-evident export bundles offline.
- [Approvals and step-up](https://insecur.cloud/docs/approvals.md): Route protected changes through a human step-up gate and poll operations to completion.

## Reference

- [Environment variables](https://insecur.cloud/docs/reference/environment-variables.md): Every environment variable the insecur CLI reads, grouped by purpose.
- [API overview](https://insecur.cloud/docs/reference/api.md): Orientation to the insecur public API: base URL, envelopes, errors, and route groups.
- [Exit codes](https://insecur.cloud/docs/reference/exit-codes.md): The stable exit codes every insecur CLI command uses.
- [Error codes](https://insecur.cloud/docs/reference/errors.md): Every stable error code the API and CLI return, with exit code, HTTP status, and type URI.

## CLI reference

- [CLI overview](https://insecur.cloud/docs/cli/index.md): Every insecur command, the global flags, and the conventions shared by all of them.
- [insecur agent](https://insecur.cloud/docs/cli/agent.md): Agent harness attribution and child sessions
- [insecur approvals](https://insecur.cloud/docs/cli/approvals.md): Metadata-only approval request status
- [insecur audit](https://insecur.cloud/docs/cli/audit.md): Audit event feed and export verification
- [insecur config](https://insecur.cloud/docs/cli/config.md): Local CLI configuration
- [insecur connections](https://insecur.cloud/docs/cli/connections.md): Manage org-scoped App Connections (metadata only)
- [insecur describe](https://insecur.cloud/docs/cli/describe.md): Describe the CLI command contract as metadata
- [insecur envs](https://insecur.cloud/docs/cli/envs.md): Environment navigation and creation
- [insecur guide](https://insecur.cloud/docs/cli/guide.md): Offline CLI guides (markdown playbooks, no auth required)
- [insecur import](https://insecur.cloud/docs/cli/import.md): Import secrets from a local dotenv file into a development environment (create-only; all-or-nothing preflight)
- [insecur init](https://insecur.cloud/docs/cli/init.md): Provision guided organization defaults and write .insecur.json
- [insecur local-files](https://insecur.cloud/docs/cli/local-files.md): Local plaintext secret file utilities (metadata-only; no secure erasure)
- [insecur login](https://insecur.cloud/docs/cli/login.md): Authenticate with WorkOS AuthKit PKCE and mint a short-lived CLI credential
- [insecur logout](https://insecur.cloud/docs/cli/logout.md): End the CLI session locally and revoke the server session
- [insecur operations](https://insecur.cloud/docs/cli/operations.md): Poll, wait on, and cancel long-running operations
- [insecur orgs](https://insecur.cloud/docs/cli/orgs.md): Organization navigation
- [insecur projects](https://insecur.cloud/docs/cli/projects.md): Project navigation and creation
- [insecur run](https://insecur.cloud/docs/cli/run.md): Run a command with runtime injection from a CLI profile policy or one exact variable key
- [insecur run-policies](https://insecur.cloud/docs/cli/run-policies.md): Manage Runtime Injection Policies (metadata only)
- [insecur scan](https://insecur.cloud/docs/cli/scan.md): Offline project-scoped secret exposure report (metadata only)
- [insecur secrets](https://insecur.cloud/docs/cli/secrets.md): Blind secret writes and metadata-only management
- [insecur shell](https://insecur.cloud/docs/cli/shell.md): Start a subshell with INSECUR_SESSION_TOKEN in the environment
- [insecur whoami](https://insecur.cloud/docs/cli/whoami.md): Report acting human, session validity, resolved context, and attribution tier

## Other resources

- [Complete documentation in one file](https://insecur.cloud/llms-full.txt): every page below concatenated as markdown
- [Error reference](https://insecur.cloud/errors): landing pages for every RFC 9457 error type URI the API and CLI return
- [Install script (macOS/Linux)](https://insecur.cloud/install.sh): curl -fsSL https://insecur.cloud/install.sh | sh
- [Install script (Windows)](https://insecur.cloud/install.ps1): irm https://insecur.cloud/install.ps1 | iex