Secrets Manager 🔐

Encrypted local secret store. AES-256-GCM authenticated encryption. Master key auto-generated on first store and stored in memory/secrets/.master-key (chmod 0600).

Important: If you lose .master-key, all stored secrets become unrecoverable. Back it up.

⚠️ Important Warnings

Encryption: AES-256-GCM (Authenticated)

• 256-bit master key, per-secret 96-bit random IV, 128-bit GCM auth tag
• Tampered ciphertext returns null from decrypt (no partial decryption)
• Master key stored in memory/secrets/.master-key with chmod 0600
• Override via SECRETS_MASTER_KEY=<hex> env var
• Losing the master key = all secrets unrecoverable