Your secrets live in six places and one of them is a DM — Chovy's Blog

Your secrets live in six places and one of them is a DM

2026-08-16, by Anthony “chovy” Ettinger.

How this was written: drafted with an AI assistant from my own notes,<br>then edited by me. I work on the tool described below, so read it as what it is — me<br>telling you about a thing I build.

The actual problem

Count where a secret for one of your projects currently lives. There is a .env on<br>your laptop. There is a copy in Doppler, or in Railway's variables tab, because that's what the<br>deploy reads. There is a third copy in GitHub Secrets so CI can run. There is a Slack DM from<br>eight months ago containing a fourth copy, sent to whoever joined that week. And there is an SSH<br>key on exactly one machine, which is why you can't work from the other one.

None of those four copies agree with each other. You find out which one is stale during an<br>outage. Meanwhile the honest onboarding instruction for a new teammate is &ldquo;ask me and I'll<br>paste it to you,&rdquo; which is a credential-sharing workflow the same way a shoebox is an<br>accounting system.

The paid tools solve one slice of this and then own you. Doppler is good at Doppler. Railway<br>is good at Railway. Neither is good at &ldquo;here is my .env, put it in both, tell<br>me what changed first, and let me undo it.&rdquo; And none of them will hold an SSH key.

What we built instead

LogicSRC Credential Sharing is an open<br>spec plus an MIT-licensed CLI for exactly that gap: provider-neutral secret sync, plus<br>end-to-end-encrypted team vaults, with an audit trail and an undo button. It's part of<br>LogicSRC, the Profullstack open-spec project — open<br>schemas and conventions for coordination between humans, agents and hosted services. The code is<br>at github.com/profullstack/logicsrc.

Install is a shell line and Node 18+, macOS or Linux:

curl -fsSL https://logicsrc.com/install.sh | sh<br>logicsrc login

The loop I actually run

Ninety percent of my use is three commands. Link a directory to a team project and environment<br>once, then push and pull the .env like it's a branch:

logicsrc secrets teams link # interactive: team &rarr; project &rarr; env<br>logicsrc secrets up # push .env to the linked environment<br>logicsrc secrets down # pull it back<br>logicsrc secrets down staging # pull a different env of the same project

The link lives in ~/.config/logicsrc/secrets-links.json, keyed by the directory's<br>real path — deliberately outside the project, so nothing about your secret storage lands in<br>the repo. There's no config file to gitignore because there's no config file.

Onboarding a teammate is four commands and no DMs:

logicsrc teams create acme --name "Acme Inc"<br>logicsrc teams push acme web prod --env .env<br>logicsrc teams invite acme teammate@example.com<br>logicsrc teams grant acme web prod teammate@example.com

They run logicsrc teams pull acme web prod --env .env and they're working. When<br>they leave, you rotate rather than hoping:

logicsrc credentials rotate acme web prod --approve

I run north of 170 vaults on one team this way, named --.<br>It scales past the point where a shared password manager entry stops being funny.

The part that matters: the server can't read your secrets

The vaults are end-to-end encrypted and the server is a zero-knowledge relay. It stores three<br>things: each member's X25519 public key, the vault's data-encryption key sealed once per member,<br>and ciphertext. Adding a member re-seals the vault key to them; it never unwraps the key<br>anywhere but on a member's machine. Removing a member is a rotation, not a permission flag flip.

This is the property that makes me comfortable putting SSH keys in it, which the CLI does as a<br>first-class thing:

logicsrc secrets ssh push profullstack # back up ~/.ssh to vault ssh--<br>logicsrc secrets ssh list profullstack # paths, kinds, modes — never key bodies<br>logicsrc secrets ssh pull profullstack # restore, permission bits intact<br>logicsrc secrets ssh agent profullstack # load into ssh-agent, never onto disk

That last one is the one I like. New machine, new container, someone else's box — keys<br>into the running agent, nothing written to disk to forget about later.

Anywhere to anywhere, with a dry run and an undo

The sync side is provider-neutral. Adapters exist for .env files, Doppler<br>(project/config-scoped), Railway service variables, GitHub Secrets (repo, org and environment),<br>sh1pt tokens for App Store Connect / Play / npm / Docker / Cloudflare, and SSH keys. Run<br>logicsrc credentials providers for the live list and what each one can do.

Every move is a plan you can look at before it happens:

logicsrc credentials diff --from env --from-path .env --to railway \<br>--to-project --to-config

logicsrc credentials plan --from env --from-path .env --to doppler \<br>--to-project --to-config

logicsrc credentials sync --plan # dry run by default<br>logicsrc credentials sync --plan --approve # actually writes<br>logicsrc credentials audit --run --format...