Secret Vault

Encrypted secret store with environment namespacing, rotation policies, per-access audit logging, and CI/CD environment injection.

Overview

Secret Vault is TotalApp's built-in encrypted credential store. It gives developers a secure, centralised place to manage API keys, database passwords, tokens, and certificates — without storing them in source code, .env files committed to git, or plain-text configuration files.

Secrets are organised by environment (development, staging, production) and by project. Every read access is logged with a timestamp and actor identity so you have a full access history for compliance purposes.

Scope of Secret Vault

Secret Vault is designed as a developer-productivity layer within TotalApp. For production infrastructure-level secrets, continue using your cloud provider's secret manager (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault). TotalApp's vault complements, not replaces, those systems.

Quick Start

Open Secret Vault from the Security sidebar.
Click New Secret. Enter a name, value, and select an environment (dev / staging / prod).
Click Save. The value is encrypted at rest and never shown in plain text again — only masked (••••••••).
To reveal a secret value, click the eye icon on the row. This action is logged.
To rotate a secret, open the detail panel and click Rotate. Enter the new value and confirm.

Bulk import

Click Import .env to bulk-import secrets from an existing .env file. All key-value pairs are parsed and stored as individual secrets in the selected environment namespace.

Features

Encryption at Rest

All secret values are encrypted using AES-256 before storage. Keys are derived per-user so even a database dump reveals no plaintext credentials.

Environment Namespacing

Separate dev, staging, and prod namespaces prevent accidental use of production credentials in development. Each environment can be locked to specific user roles.

Rotation Policies

Set a rotation interval (30 / 60 / 90 days) on any secret. Vault sends a notification when a secret is approaching or past its rotation date.

Access Audit Log

Every reveal, copy, and rotation event is logged with the actor identity, timestamp, and IP address. Export the log as CSV for compliance reports.

CI/CD Injection

Reference vault secrets in your CI/CD pipeline using the $VAULT:secretName syntax. The TotalApp CI connector resolves references at pipeline start-time without exposing values in logs.

.env Import & Export

Import from an existing .env file or export all secrets in a namespace to a .env file for local development. Export always prompts for confirmation and is logged.

Secret Lifecycle

State	What it means	Action available
Active	Secret is current and within rotation window	Reveal, Copy, Rotate, Delete
Rotation due	Secret has passed its rotation date	Rotate (highlighted), Reveal, Delete
Compromised	Manually flagged as potentially exposed	Rotate immediately, View access log
Retired	Replaced by a newer version after rotation	View value (read-only), Delete

FAQ

Where are secrets stored?

Secrets are stored in TotalApp's server-backed JSON data layer (/api/data/secret-vault), encrypted at rest using AES-256. The encryption key is derived from the authenticated user's session token and never persisted alongside the data.

Can team members share a secret namespace?

Shared namespaces are on the roadmap. Currently each user's vault is private to their account. The planned sharing model will use RBAC — owners can grant read-only or read-write access to specific team members per environment.

What happens to secrets if I delete my account?

All encrypted secret data is permanently deleted when an account is deleted. There is no recovery path. Export any secrets you need before account deletion.