An enterprise password and DevOps-secrets platform where the server never sees plaintext. Human credentials and machine secrets live in one vault, federated to WeldForge for identity. Running in production.
- Zero-knowledge vault — Argon2id-derived master key, device pairing, Emergency Kit recovery
- Machine secrets — workload identity, CI OIDC token exchange, and secret injection into a process without writing them to disk
- One-time external sharing — a server-blind proof-of-key exchange: the key never crosses the wire, a wrong key never consumes the single view, and the link locks after ten attempts
- Tamper-evident audit — Merkle-chained log with HMAC and Ed25519 anchors, RFC 3161 timestamping, WORM archive
Built on
Java · Spring Boot · PostgreSQL 18 · Flyway · database-per-service · React/Vite web · Electron desktop · Chrome extension · Go CLI · OIDC (WeldForge) · Cucumber + Testcontainers