Who is this beta for?
Developers evaluating project and environment secrets with Cloudflare Workers. Use test values: HushVault is pre-release and not production-ready.
Frequently asked questions
What you can evaluate now, what remains beta, and where the deployment trust boundary sits.
How do I use it?
Create an evaluation account, add a project with test values, and inspect the Worker sync preview. The CLI exists but has no public distribution while the repository is private. Cloudflare Workers, GitLab, GitHub Actions and Cloudflare Pages secrets sync is in beta (manual runs; the bulk endpoint has been tested against a real Worker, with edge cases still unverified). Microsoft Azure, Slack and Webhooks are planned and not available yet.
Read the docs for setup examples.Can I self-host?
Not from the public website. The repository is private, and the existing deployment notes are specific to HushVault’s account. See the current status.
How does master key rotation work?
Envelope encryption means rotating the master key only requires re-wrapping the data encryption keys (DEKs); the secret ciphertext in KV is never touched. Rotation is implemented: you add the new key alongside the old one, point the deployment at it, and a scheduled job re-wraps the stored DEKs in batches while every row stays readable under whichever key version it was wrapped with. Admins can watch progress through the API.
How do API tokens rotate?
Create a new API key, replace the value in the consuming environment, and revoke the old key. Keys can be created and revoked through the API. HushVault stores encrypted secret material separately from API authentication keys.
What makes HushVault secure?
Secret values are stored using AES-256-GCM envelope encryption. The deployment server holds the master key and decrypts stored values when serving them. HushVault is pre-release, has not had an independent security audit, and holds no compliance certification. Read the security model.