{"slug": "secrets-live-in-six-places-and-one-of-them-is-a-dm", "title": "Secrets live in six places and one of them is a DM", "summary": "LogicSRC Credential Sharing, an open spec and MIT-licensed CLI from the Profullstack project, aims to solve fragmented secret management by providing provider-neutral sync, end-to-end-encrypted team vaults, audit trails, and an undo button. The tool, which supports .env files and SSH keys, uses zero-knowledge relay so the server cannot read secrets, and the author reports running over 170 vaults on one team.", "body_md": "# Your secrets live in six places and one of them is a DM\n\n*2026-08-16, by Anthony “chovy” Ettinger.*\n\n**How this was written:** drafted with an AI assistant from my own notes,\nthen edited by me. I work on the tool described below, so read it as what it is — me\ntelling you about a thing I build.\n\n## The actual problem\n\nCount where a secret for one of your projects currently lives. There is a `.env`\n\non\nyour laptop. There is a copy in Doppler, or in Railway's variables tab, because that's what the\ndeploy reads. There is a third copy in GitHub Secrets so CI can run. There is a Slack DM from\neight months ago containing a fourth copy, sent to whoever joined that week. And there is an SSH\nkey on exactly one machine, which is why you can't work from the other one.\n\nNone of those four copies agree with each other. You find out which one is stale during an outage. Meanwhile the honest onboarding instruction for a new teammate is “ask me and I'll paste it to you,” which is a credential-sharing workflow the same way a shoebox is an accounting system.\n\nThe paid tools solve one slice of this and then own you. Doppler is good at Doppler. Railway\nis good at Railway. Neither is good at “here is my `.env`\n\n, put it in both, tell\nme what changed first, and let me undo it.” And none of them will hold an SSH key.\n\n## What we built instead\n\n[LogicSRC Credential Sharing](https://logicsrc.com/credential-sharing) is an open\nspec plus an MIT-licensed CLI for exactly that gap: provider-neutral secret sync, plus\nend-to-end-encrypted team vaults, with an audit trail and an undo button. It's part of\n[LogicSRC](https://logicsrc.com/), the Profullstack open-spec project — open\nschemas and conventions for coordination between humans, agents and hosted services. The code is\nat [github.com/profullstack/logicsrc](https://github.com/profullstack/logicsrc).\n\nInstall is a shell line and Node 18+, macOS or Linux:\n\n```\ncurl -fsSL https://logicsrc.com/install.sh | sh\nlogicsrc login\n```\n\n## The loop I actually run\n\nNinety percent of my use is three commands. Link a directory to a team project and environment\nonce, then push and pull the `.env`\n\nlike it's a branch:\n\n```\nlogicsrc secrets teams link      # interactive: team → project → env\nlogicsrc secrets up              # push .env to the linked environment\nlogicsrc secrets down            # pull it back\nlogicsrc secrets down staging    # pull a different env of the same project\n```\n\nThe link lives in `~/.config/logicsrc/secrets-links.json`\n\n, keyed by the directory's\nreal path — deliberately outside the project, so nothing about your secret storage lands in\nthe repo. There's no config file to gitignore because there's no config file.\n\nOnboarding a teammate is four commands and no DMs:\n\n```\nlogicsrc teams create acme --name \"Acme Inc\"\nlogicsrc teams push acme web prod --env .env\nlogicsrc teams invite acme teammate@example.com\nlogicsrc teams grant acme web prod teammate@example.com\n```\n\nThey run `logicsrc teams pull acme web prod --env .env`\n\nand they're working. When\nthey leave, you rotate rather than hoping:\n\n```\nlogicsrc credentials rotate acme web prod --approve\n```\n\nI run north of 170 vaults on one team this way, named `<project>--<env>`\n\n.\nIt scales past the point where a shared password manager entry stops being funny.\n\n## The part that matters: the server can't read your secrets\n\nThe vaults are end-to-end encrypted and the server is a zero-knowledge relay. It stores three\nthings: each member's X25519 public key, the vault's data-encryption key sealed once per member,\nand ciphertext. Adding a member re-seals the vault key *to* them; it never unwraps the key\nanywhere but on a member's machine. Removing a member is a rotation, not a permission flag flip.\n\nThis is the property that makes me comfortable putting SSH keys in it, which the CLI does as a first-class thing:\n\n```\nlogicsrc secrets ssh push profullstack    # back up ~/.ssh to vault ssh--<you>\nlogicsrc secrets ssh list profullstack    # paths, kinds, modes — never key bodies\nlogicsrc secrets ssh pull profullstack    # restore, permission bits intact\nlogicsrc secrets ssh agent profullstack   # load into ssh-agent, never onto disk\n```\n\nThat last one is the one I like. New machine, new container, someone else's box — keys into the running agent, nothing written to disk to forget about later.\n\n## Anywhere to anywhere, with a dry run and an undo\n\nThe sync side is provider-neutral. Adapters exist for `.env`\n\nfiles, Doppler\n(project/config-scoped), Railway service variables, GitHub Secrets (repo, org and environment),\nsh1pt tokens for App Store Connect / Play / npm / Docker / Cloudflare, and SSH keys. Run\n`logicsrc credentials providers`\n\nfor the live list and what each one can do.\n\nEvery move is a plan you can look at before it happens:\n\n```\nlogicsrc credentials diff --from env --from-path .env --to railway \\\n  --to-project <projectId> --to-config <environmentId>\n\nlogicsrc credentials plan --from env --from-path .env --to doppler \\\n  --to-project <project> --to-config <config>\n\nlogicsrc credentials sync --plan <planId>             # dry run by default\nlogicsrc credentials sync --plan <planId> --approve   # actually writes\nlogicsrc credentials audit --run <runId> --format markdown\nlogicsrc credentials rollback --run <runId>\n```\n\nThree design decisions in there that I'd defend to anyone:\n\n**Dry run is the default.**`sync`\n\nwithout`--approve`\n\nwrites nothing. You have to say the word.**Plans, diffs and audits are redacted.** They show key names, targets, fingerprints and timestamps — never values. You can paste an audit into a ticket.**Rollback captures a pre-image.** Undo is a new plan that restores what was there, not a prayer that someone kept a copy.\n\n## Where it's rough\n\nI'm not going to oversell an 0.1.x. The CLI reports `0.1.2`\n\nas I write this. Two\nthings will bite you early:\n\n`teams pull`\n\nwrites the decrypted`.env`\n\ninto the*current directory*unless you pass`--env <path>`\n\n. Cd into the project first.`push`\n\nauto-creates a vault when`<project>--<env>`\n\ndoesn't exist, which means a typo silently makes a new vault instead of erroring. Check`logicsrc teams vaults <team>`\n\nbefore pushing somewhere new.\n\nAlso: `logicsrc --help`\n\nonly lists the top-level groups. The interesting\nsubcommands live under `logicsrc teams --help`\n\nand\n`logicsrc credentials --help`\n\n. Don't conclude something is missing from the top-level\nhelp alone — I have done exactly that to myself.\n\n## Why open spec\n\nCredential management is the last place you want a black box, and the second-to-last place you want a lock-in. The spec is public and the client is MIT, which means you can read what gets sent to the relay, verify that the sealing happens on your machine, and fork the thing if we disappear. That's not a marketing position, it's the only arrangement that makes sense for software whose entire job is holding the keys.\n\nSpec, adapter list and full command reference:\n[logicsrc.com/credential-sharing](https://logicsrc.com/credential-sharing). If you try\nit and something's wrong, the issues are open.", "url": "https://wpnews.pro/news/secrets-live-in-six-places-and-one-of-them-is-a-dm", "canonical_source": "https://anthony.dev.profullstack.com/blog/009-post.html", "published_at": "2026-08-16 10:03:24+00:00", "updated_at": "2026-08-16 10:40:59.617065+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["LogicSRC", "Profullstack", "Anthony Ettinger", "Doppler", "Railway", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/secrets-live-in-six-places-and-one-of-them-is-a-dm", "markdown": "https://wpnews.pro/news/secrets-live-in-six-places-and-one-of-them-is-a-dm.md", "text": "https://wpnews.pro/news/secrets-live-in-six-places-and-one-of-them-is-a-dm.txt", "jsonld": "https://wpnews.pro/news/secrets-live-in-six-places-and-one-of-them-is-a-dm.jsonld"}}