Secretbank

The secrets manager that understands your dependency graph.

About

Secretbank is an open-core desktop and mobile application that goes beyond simple secret storage. It maps how API keys relate to your projects, deployments, and URLs — so you always know the blast radius before you rotate or revoke a key. When a provider reports a breach, Secretbank matches it to your vault automatically and surfaces exactly which services are at risk.

Features

Status: v0.1.0-pre8 (free beta) — every feature listed below is enabled. We will keep the entire app free until we (1) finish dogfooding, (2) ship the general-password vault, (3) get legal review of payment terms, and (4) collect feedback from the first 100–500 users. See docs/project-decisions.md for the full rationale.

Available now

• Zero-Knowledge vault — secrets are encrypted on-device; the relay server never sees plaintext
• Vault Charter recovery — Diceware 6-word + 4-digit verifier with optional Shamir 2-of-3 split. Lose your passphrase, not your vault.
• Dependency graph — visual map of Issuer → Credential → Usage → Project → Deployment → URL
• Blast radius preview — simulate what breaks before you revoke a key
• Supply chain risk graph — match package.json / Cargo.toml deps against the OSV.dev advisory feed
• Incident feed — auto-match NVD / GitHub Advisory alerts to credentials in your vault
• Kill Switch — one-click revoke with two-step confirmation
• RAILGUARD — auto-generate .cursorrules / CLAUDE.md / Copilot instructions for AI editors
• CLI + MCP — Secretbank run -- cmd (Doppler-style env injection from your dependency graph) and a stdio MCP server for Claude / Cursor / Copilot
• VS Code + JetBrains plugins — package hover, supply-chain diagnostics, blast-radius graph
• Multi-device E2EE sync — Yjs CRDT + XChaCha20-Poly1305 over a Cloudflare Workers relay
• Open Core — local vault and graph engine are AGPL-3.0; relay and premium connectors are EE

Roadmap (no committed dates)

• General password vault (1Password-style URL/username/password) — M24, in active design
• Auto-revoke for Stripe / GitHub / AWS keys
• Auto-rotation with provider hooks
• Browser extension (Chrome / Firefox / Safari)
• Team / org / shared vault (RBAC + SSO)
• Mobile apps (iOS / Android via Tauri Mobile)

Tech Stack

Layer	Technology
Desktop/Mobile shell	Tauri v2 (Rust backend + Web frontend)
Backend	Rust (tokio, sqlx, age, reqwest)
Frontend	React 19 + TypeScript
Styling	Tailwind CSS v4 + shadcn/ui + Radix UI
Database	SQLite (local, via tauri-plugin-sql)
Encryption	age crate (X25519 + ChaCha20-Poly1305)
Sync	Yjs / SecSync CRDT + Cloudflare Workers relay

Platforms

Platform	Status
Windows / macOS / Linux	MVP (M0–M8)
iOS / Android	MVP (M11)
Read-only Web viewer	MVP (M12)

Getting Started

Prerequisites

• Node.js 20+
• Rust stable — rustup install stable
• pnpm — npm install -g pnpm
• Tauri v2 system dependencies

Development

pnpm install
pnpm tauri dev        # desktop (hot reload)

Mobile (available from M11):

pnpm tauri android dev
pnpm tauri ios dev

Production build

pnpm tauri build

Development Commands