Security
Security model
The collector holds real credentials; the viewer holds none of them. Each boundary is enforced in code or by the database, and the known residuals are named.
The collector holds real credentials
It runs with a 1Password service account that can read plaintext, plus the CapRover and Vercel credentials. Run it only in a dedicated CI environment with branch protection and code-owner review, never on a shared self-hosted runner.
Each env-sync child gets only the base floor and its own platforms’ credentials, a fresh empty home directory, and the platform guard variable.
The database is append-only for the collector
The collector role can insert and nothing else; the viewer role can select and nothing else. Row-level security is forced, and the platform’s default roles are revoked from the schema.
The viewer sees no values
No value is stored. Fingerprints stay on the server. The access gate needs a session and a confirmed address on the viewer allowlist.
What it does not do
It does not fix drift, write to any target, or rotate secrets: it only runs env-sync diff.
It does not isolate env-sync children as processes: a child running as the same user could read the collector’s environment from the operating system. Scoping picks the right credential; it is not a sandbox.
It does not prove a matching value is correct or safe, only that the target agrees with the source.
Know which secrets drifted, without seeing them
env-sync-viewer is self-hosted: you run the collector and the viewer in your own infrastructure. Access to the repository is by request.