Keys end up pasted into chats, config files and notes, because that is the fastest thing to do at the moment you need one. Months later nobody knows which of six services that token belongs to, and it is in a file history forever.
Each key, token and password is encrypted on your machine behind a password only you know.
It asks the vault for the exact key at the moment it needs it. You never paste one into a conversation again.
A sweep of your project reports any key left sitting in plain text, with the file and the line, before it ever reaches a commit.
Every key, token and password encrypted on your machine, behind one password.
Your AI fetches the key it needs by itself, at the moment it needs it.
Sweeps your whole project and flags any key left in plain text, with the file and the line.
It knows what a real key looks like: it catches twelve providers, not just yours.
Opens on its own too, by double click, when you just want to look something up.
If you lose the password, the file is gone. That is what makes it safe.
It protects against leaking and forgetting. It is not a shared team vault.
Vault
Stop pasting keys into chats. They sit encrypted on your machine and your AI takes what it needs.