Security architecture

Local-first credential access with an explicit threat boundary.

Vibe Vault reduces credential exposure in AI coding workflows by keeping a local source of truth, gating reads, and recording access metadata. It is not malware protection, provider IAM, or a tamper-proof compliance system.

Install CLI Read Threat Model

Architecture

Secrets stay local unless you explicitly use them elsewhere.

The Solo product has no hosted Vibe Vault account. Provider sync, downloads, checkout, and support contact are user-initiated external actions.

Storage

Secret values live in encrypted local vault storage. On macOS the master key is in Keychain; on Linux it uses libsecret (mode-0600 file fallback); on Windows it uses DPAPI.

Access

Reads can be gated by local approval before a value is copied, injected, served through MCP, or pushed to a provider.

Audit

Audit rows record metadata such as secret name, agent, project context, action, result, and timestamp.

Secret lifecycle

Every useful action is explicit.

The product is built around a narrow local runtime path: store, request, approve, use, audit.

01
Add, import, or generate

Create a secret locally, import from a provider dashboard, or generate a random value in the app.

local
02
Encrypt and store

The encrypted vault lives on disk. On macOS the master key is in Keychain; on Linux it uses libsecret with a file fallback; on Windows it uses DPAPI.

encrypted
03
Agent or command requests

Cursor, Claude Code, Devin, VS Code, or a shell command requests a named value through CLI, MCP, copy, or sync.

brokered
04
Local approval

Reads can require a local session or Touch ID approval before release.

gated
05
Use and record

The value is copied, injected, served, or pushed; an audit event records metadata, not the raw value.

audited

Controls

Defense is workflow-shaped.

Vibe Vault focuses on the places AI coding credentials leak in practice: repo files, local config, agent setup, copy-paste, and broad env injection.

Repo scanner

vibevault scan finds expected env names and tracked local secret-bearing files before an agent session.

Git guard

The pre-commit guard blocks tracked .env*, .mcp.json, .cursor/mcp.json, and .claude/settings.local.json.

Agent setup

vibevault cursor prepare wires MCP, rules, skills, ignore rules, and guardrails for the current project.

Browser import

The importer saves newly generated provider keys into the local vault through a native host after explicit user action.

Provider sync

Cloudflare, Vercel, and PushCI receive selected secrets only when the user runs an explicit sync.

Encrypted sync bundle

Mac-to-Mac sync uses an encrypted bundle and passphrase. It is not a hosted LunaOS cloud vault.

Boundaries

What Vibe Vault can and cannot protect.

The honest boundary matters more than broad security language.

Designed to reduce
  • Copy-paste of raw keys into AI chats and notes.
  • Tracked .env and agent config files.
  • Unclear local access by agents and shell commands.
  • Manual provider updates after key rotation.
  • Missing after-the-fact evidence for agent reads.
Not designed to guarantee
  • Protection after an approved process receives a value.
  • Defense against full local malware or device compromise.
  • Automatic provider revocation after a leak.
  • Tamper-proof centralized compliance logs.
  • SSO, SCIM, SIEM export, or centralized admin in v0.1.

Source-visible core

The security story should be inspectable.

The CLI, VaultCore package, MCP server, browser host, skills, threat model, and launch evidence live in the repository. Public launch still requires signed and notarized distribution before broad posting.

View Repository Threat Model Run Scanner First