Blog / tag
Internals
How envsec works under the hood.
One CLI, three keychains
How envsec stores secrets through macOS security, Linux secret-tool and Windows CredWrite behind one Effect service, and why every value is base64.
Why secret values live in the keychain and metadata in SQLite
envsec keeps secret values in the OS keychain and names, expiry and export records in SQLite: why, what that reveals, and what happens when one write fails.