{
  "slug": "safe/quickstart",
  "title": "Safe Quickstart",
  "description": "Create a local Cuitty Safe, replace env values with references, and resolve them at runtime.",
  "url": "https://cuitty.com/docs/safe/quickstart",
  "markdown_url": "https://cuitty.com/docs/safe/quickstart.md",
  "json_url": "https://cuitty.com/docs/safe/quickstart.json",
  "frontmatter": {
    "title": "Safe Quickstart",
    "description": "Create a local Cuitty Safe, replace env values with references, and resolve them at runtime.",
    "order": 1,
    "section": "Safe",
    "updatedAt": "2026-06-09"
  },
  "headings": [
    {
      "depth": 1,
      "slug": "safe-quickstart",
      "text": "Safe Quickstart"
    },
    {
      "depth": 2,
      "slug": "install",
      "text": "Install"
    },
    {
      "depth": 2,
      "slug": "create-a-local-safe",
      "text": "Create a local Safe"
    },
    {
      "depth": 2,
      "slug": "replace-env-values-with-references",
      "text": "Replace env values with references"
    },
    {
      "depth": 2,
      "slug": "run-with-resolved-env",
      "text": "Run with resolved env"
    },
    {
      "depth": 2,
      "slug": "use-package-scripts",
      "text": "Use package scripts"
    },
    {
      "depth": 2,
      "slug": "next-steps",
      "text": "Next steps"
    }
  ],
  "body_markdown": "# Safe Quickstart\n\nCuitty Safe lets you commit references such as `cuitty-safe:acme/dev/database-url` instead of raw secret values. The resolver injects the real value only at the runtime boundary.\n\n## Install\n\nRepository contributors should route package changes through Socket Firewall and pin exact versions.\n\n```bash\nsfw bun add @cuitty/safe@0.1.0\n```\n\nThe CLI binary target is `cuitty-safe`. Some Cuitty installs may also expose it as `cui safe`.\n\n## Create a local Safe\n\nLocal vault mode is the default first-run mode.\n\n```bash\ncuitty-safe init\ncuitty-safe safe create acme/dev --provider local\ncuitty-safe put acme/dev/database-url --value \"$DATABASE_URL\"\ncuitty-safe put acme/ci/github-token --value \"$GITHUB_TOKEN\"\n```\n\nThe values above come from your current shell. Do not paste real values into committed docs, scripts, or examples.\n\n## Replace env values with references\n\n```dotenv\nDATABASE_URL=cuitty-safe:acme/dev/database-url\nGITHUB_TOKEN=cuitty-safe:acme/ci/github-token\n```\n\nBare paths are valid only when Cuitty Safe is the active resolver:\n\n```dotenv\nDATABASE_URL=acme/dev/database-url\n```\n\n## Run with resolved env\n\n```bash\ncuitty-safe run --env-file .env -- bun run dev\n```\n\n`run` resolves references, injects values into the child process environment, and keeps terminal output masked by default.\n\n## Use package scripts\n\n```jsonc\n{\n  \"scripts\": {\n    \"dev\": \"cuitty-safe run --env-file .env -- vite\",\n    \"deploy\": \"cuitty-safe run --scope acme/prod -- bun run deploy:raw\"\n  },\n  \"cuittySafe\": {\n    \"env\": {\n      \"DATABASE_URL\": \"acme/dev/database-url\",\n      \"GITHUB_TOKEN\": \"acme/ci/github-token\"\n    }\n  }\n}\n```\n\nPrefer `cuitty-safe run` over shell command substitution. Substitution can leak sensitive values into shell history, process listings, or logs.\n\n## Next steps\n\n- [Reference syntax](/docs/safe/references)\n- [Storage modes](/docs/safe/storage-modes)\n- [CI/CD](/docs/safe/ci-cd)\n- [Security model](/docs/safe/security)",
  "links_out": [
    "/docs/safe/references",
    "/docs/safe/storage-modes",
    "/docs/safe/ci-cd",
    "/docs/safe/security"
  ]
}