Secrets belong to the runtime,
not the repository.

The 0.3.1 local vault, provider storage and runtime workflow. Explore the architecture for implementation details and future boundaries.
Watch the SourceOrrery walkthrough on YouTube (opens in a new tab)

SourceOrrery is a local-first secrets platform built around a shared Rust core. Its modular architecture separates cryptography, storage and provider integrations, while read-only language SDKs give applications a consistent way to retrieve secrets at runtime. Project files hold references, keeping credential values out of committed configuration.

Technical highlights include:

• Modular Rust architecture: Dedicated crates separate cryptographic operations, vault storage, lifecycle policy and provider access, making each responsibility easier to inspect and test.
• Consistent language SDKs: Thin bindings reuse the Rust implementation, with shared conformance tests checking lifecycle behaviour and read-only operations across languages.
• Encrypted local storage: Secret values use XChaCha20-Poly1305 encryption in a SQLite vault, with machine access through the OS credential store and a recovery key for portability.
• Cloud provider integrations: Retrieve values from AWS Secrets Manager, Azure Key Vault or HashiCorp Vault through the same application interface, with provider capabilities documented explicitly.
• Careful handling of sensitive data: Zeroising native buffers and redacted key types reduce exposure within the Rust core. Applications remain responsible for values copied into their own memory.
• Lifecycle controls and auditability: Versioning, activation, expiry and tamper-evident audit records support traceable secret management.
• Documented security boundaries: The threat model explains current protections, limitations and planned controls, helping developers assess where SourceOrrery fits.

SourceOrrery 0.3.1

An encrypted local vault, CLI, interactive vault manager and read-only SDKs for Windows, macOS and Linux. This build includes a .env importer and integrations for AI coding agents. See the roadmap for what comes next.

From a credential to a reference

SourceOrrery is a local-first secrets platform written in Rust. Use the CLI to manage credentials and a value-free project manifest to declare what your app needs. Read them through an SDK, or inject them into a child process at launch.

Encrypted local storage

Secret values are encrypted with XChaCha20-Poly1305 in a SQLite vault. This machine’s key lives in your OS credential store; a recovery key opens the vault anywhere else.

References in your repository

Declare which secrets your project needs in its manifest. Inline value fields are rejected; keep names and other metadata free of secrets too.

Metadata by default

Inspect names, versions and status without printing secret values. Revealing a value requires an explicit get --reveal.

A complete secret lifecycle

Version values, enforce activation and expiry, recover soft-deleted secrets, and inspect a tamper-evident audit log.

Setup options

Option 1: Set up with the CLI

Install SourceOrrery, then run these commands in your project directory. The secret prompt is hidden; values are never command-line arguments.

Create a development vault

sourceorrery setup                     # the vault, its recovery key, its checks and storage
sourceorrery secret set database-password --vault development
sourceorrery secret list --vault development

Declare the secret in a project manifest. The vault and secret name resolve to sourceorrery://development/database-password:

sourceorrery.toml

[project]
name = "my-app"
vault = "development"

[secrets.database-password]
env = "DATABASE_PASSWORD"

Check the manifest and launch your app

sourceorrery check
sourceorrery run -- npm start

npm start receives DATABASE_PASSWORD; your parent shell is unchanged. The child process can read and disclose its environment, so run code you trust. The getting started guide covers unlocking, verification and working without an OS credential store.

Option 2: Set up with an AI coding agent

sourceorrery init --integration all

Use your existing coding agent and ask: “Set up SourceOrrery for this project without showing secret values.” Replace all with your agent’s name to install only its skills. The agent handles the manifest, code and launch commands; you create vaults and enter values privately. The agent setup guide also covers updating skills from the repository independently of the CLI.

Use your language

All SDKs are read-only and share the Rust core’s semantics. Manage vaults and secret versions with the CLI, then read values through a scoped accessor in your application.

• PythonSDK guidePyPI
• JavaScript / TypeScriptSDK guidenpm
• RustSDK guidecrates.io
• JavaSDK guideMaven Central
• .NETSDK guideNuGet
• GoSDK guidepkg.go.dev
• CSDK guideRelease archives
• C++SDK guideRelease archives
• PHPSDK guidePackagist

Know the security boundary

Local protection, with clear limits

SourceOrrery protects persisted vault values, enforces version policy and records access. It is designed for development credentials and has not received an independent security audit. A process that can unlock the vault can read it. The authenticated broker and per-runtime access controls are planned, not available today.

Protection	Available today
Secret values encrypted in the vault	Yes. Names, tags and other metadata remain visible.
References instead of credentials in project files	Yes, when you keep secret values out of names, comments and metadata.
Version policy and tamper-evident audit records	Yes. A full rollback of the vault needs an external checkpoint to detect.
Isolation from an agent running as your user	No. Local unlock access is the current boundary.

Read the threat model before choosing where to use SourceOrrery. It distinguishes vault protection from secrets copied into application memory, logs, process environments or other files.

How it fits together

The CLI and SDKs use the same Rust implementation. A manifest stores references. The local vault stores encrypted local values and the catalog of provider-backed secrets; the application chooses when to resolve them.

Find your next step

Getting startedInstall, create a vault and run your first application.AI coding agentsSet up SourceOrrery and migrate a project with value-safe agent skills.Docker, WSL and CIUnlock a vault in a headless environment.CLI referenceLook up commands, flags, environment variables and exit codes.Supply chainCheck packages, release checksums and publishing provenance.Build from sourceBuild the CLI, native library and language bindings.