Change customer secrets without blindly breaking their applications.
Discover provider bindings, prove what HushVault owns, preview the change, push it through a controlled workflow, and retain value-free verification evidence for the client.
Private beta for evaluation only. Not production-ready or independently audited. Understand the trust boundary before adding sensitive values.
DATABASE_URLNot present on WorkerCreateREDIS_URLPreviously synced by HushVaultUpdateSTRIPE_KEYAlready exists · not managed by HushVaultConflictUnmanaged names untouched · deletion offIllustrative interface · no live customer data
A provider-aware change ledger for agencies and MSPs.
HushVault connects each secret to its customer environment, provider binding and verification result. Its preview refuses unmanaged overwrites, records provider acceptance separately from application health, and produces a value-free change certificate.
Cloudflare Workers and Pages, GitHub Actions and GitLab are beta integrations with different capabilities. Microsoft Azure is planned for Key Vault and App Service workloads. Unsupported actions stay absent, and deployment-specific evidence remains pending where it has not passed a live drill.
See the intended change. Keep existing secrets safe.
The preview shows names and proposed actions without showing secret values. Sync is manual by default, with opt-in automatic triggers in beta; a failed resolution blocks provider writes.
Choose the source
Resolve a project environment, including inherited and computed values, before anything is sent.
Project → environmentPreview customer changes
See creates, updates, skips, and conflicts. Existing provider bindings that HushVault does not own are left alone.
Preview before manual syncKeep deletion deliberate
Removal from a Worker is off by default and applies only to names HushVault previously synced.
Managed names onlyKnow who can decrypt your secrets.
Stored values use AES-256-GCM envelope encryption. The deployment server holds the master key and decrypts values when serving them; HushVault is not zero-knowledge for stored secrets.
Read the security modelCore project and environment workflow · Cloudflare, GitLab, and GitHub Actions integrations in beta · Microsoft Azure planned · paid plans unavailable.
Production use and an independent security audit are still ahead.
Try the workflow with test values.
Create an evaluation account, set up a project with test values, and inspect the Worker sync preview. The repository and self-hosting source are private.