Security posture
What we claim, and what we don’t
insecur is named after the problem, so we don’t get to pretend it away. Here is the boundary in plain terms: what the design protects, where it stops, and how you can check it yourself.
The boundary
The protected-environment design has no plaintext read-back path through the product. Production delivery and security verification remain incomplete. Do not use the service for valuable production secrets.
Development secrets are stored encrypted and injected into a child process. An agent controlling that process can read the values. Hosted injection uses short-lived single-use grants. Automatic credential rotation and one-button recovery are not available.
What we never say: that insecur is zero-knowledge, that we cannot decrypt, or that the running process is technically incapable of reading its own environment. The running process gets the value it was given. Our claim is about the workflow before that, and about who can read a Protected Environment value back through the product.
Hosted architecture
Capability isolation, not a monolith
insecur runs as separate Cloudflare Worker deploys. Exactly one holds the root key and it serves zero public routes. No deploy holds both a public route and the key that decrypts.
One place decrypts
Ciphertext becomes plaintext in a single deploy with no public HTTP path, reached only over a private Service Binding carrying a short-lived scoped token. There is no public route to the thing that can decrypt.
Tenant-bound keys
Every secret is encrypted under a key bound to your tenant, so a leak in one organization cannot decrypt another. When something leaks, it leaks small.
Every use on the record
Which identity asked for which secret, when, from where. Hosted grants and use are audited. This records access through insecur, not every read or leak inside a process.
Check it yourself
insecur is experimental. Read the source code, the security model, the threat model, and the launch blockers before evaluating it. Architecture describes the intended controls; it does not establish that the service is ready for production secrets.