Security
How KeyEnv protects your secrets.
What we encrypt, how, and who can read it. Written plainly, including the limits.
Encrypted before it is stored.
KeyEnv encrypts secrets on the server, at rest. The API decrypts a value only to hand it to a person or token that is allowed to read it.
- AES-256-GCM
- Every secret value is encrypted with AES-256-GCM before it is written to the database, with a fresh random nonce on every write. GCM also detects tampering.
- HKDF-SHA256
- The 256-bit encryption key is derived from the master key with HKDF-SHA256 rather than used directly.
- Bound to its row
- Each ciphertext is sealed with additional authenticated data that ties it to its own record, so an encrypted value cannot be copied onto a different secret.
- TLS in transit
- Traffic is encrypted between your machine and Cloudflare, and again between Cloudflare and our servers.
This is not end-to-end encryption. KeyEnv's servers hold the key, which is what lets keyenv run, CI tokens, rotation, and the web app work without every client sharing a key. A stolen database backup alone does not expose your secrets.
Access is explicit, and every read is recorded.
- Roles per environment
- Admin, write, read, or none, set separately for development, staging, and production.
- Service tokens
- Scoped, revocable tokens for CI/CD, with atomic rotation and a grace period.
- Audit log
- Every read and every change is recorded with who, when, and from where.
- Secret values stay out of logs
- API request logs record the request, never the secret values in it.
Where it runs.
The API and its PostgreSQL database run on Hetzner servers behind Cloudflare, which provides DDoS protection and a web application firewall. Sign-in is handled by Clerk and payments by Stripe; neither ever sees secret values.
Report a vulnerability.
Please tell us before disclosing publicly, so we can fix it first. We aim to acknowledge reports within 24 hours.
Email [email protected] with:
- What the vulnerability is
- Steps to reproduce it
- The impact you expect
- A suggested fix, if you have one