Cuitty Safe
A developer-first secret vault and resolver.
vault + resolver · Shamir splitsenv injection, rotation, audit trailemits → observe, code, store, registry
$ cui safe resolve safe://acme/db/password
vault: local (AES-256-GCM) → resolved in 2ms
$ cui safe run -- node server.js
injected 3 secrets into child process env
observe: 3 safe.resolve events emitted
Commit references. Resolve at the boundary.
Replace raw secrets in env files, package scripts, CI/CD pipelines, generated config, Code Apps, and Registry jobs with stable plaintext references. Values stay in your vault — references are safe to commit.
Code CI runners, Registry publish tokens, and Architect cloud credentials all resolve through the same Safe vault at process boundaries.
Commit references
A stable path like account/safe/secret replaces every
raw value. Check references into version control without risk.
Resolve at the boundary
cuitty-safe run resolves references and injects values
only into the child process environment. No plaintext on disk.
Keep values out of systems
Git history, CI logs, container images — references flow through every system. Secrets never leave the vault until the moment of use.
One path shape across every vault
Three reference forms, one resolution contract. Bare paths for convenience, URI schemes for disambiguation, inline ciphertext for self-contained secrets that need no external vault.
| Form | Example | Resolves to |
|---|---|---|
| Bare path | acme/db/password | Local vault lookup |
| URI scheme | cuitty-safe:acme/db/password | Connector-routed lookup |
| Inline ciphertext | csafe:v1:aes-256-gcm:... | In-place decryption |
Four storage modes
Start with the local vault. Add connectors as your workflow grows. Every mode uses the same reference shape and the same resolution contract.
Local vault
OS credential store for key material. AES-256-GCM authenticated encryption. Metadata-only audit events for reads.
Inline encrypted text
Authenticated ciphertext embedded beside your config. Self-contained — no external vault needed for this reference.
Store adapter
End-to-end encrypted sync through Cuitty Store. Currently in alpha pending security review, recovery, and revocation testing.
1Password pass-through
Use 1Password as the source of truth. Cuitty Safe provides a stable reference path and connector metadata on top.
Wired into the platform
Safe references work everywhere Cuitty runs — in Code app manifests, CI runner environments, webhook signing, Registry publish tokens, OCI credentials, and the desktop vault UI.
Cuitty Code App manifests, CI env, webhook signing
Cuitty Registry Publish tokens, OCI creds, signing keys
Desktop app Vault lock, reveal countdowns, audit