AI coding agents are reading your .env.
Stop them with Touch ID.

Executes dev servers or scripts with decrypted secrets injected into the process environment. No plaintext .env is written to disk, so tools and AI agents reading your project files only find the decoy.

Hardware-encrypts target file into an AES-256-GCM .vault. Replaces the file on disk with safe masked dummy values (locked_by_sec) so linters and parsers continue to work without exposing keys.

Decrypts vault secrets into an ephemeral buffer with strict 0600 permissions, opens your $EDITOR (nano or vim in the terminal by default), re-encrypts on save and deletes the buffer. Unsaved edits are kept as an encrypted rescue copy, never plaintext.

Prompts Touch ID and prints decrypted secrets to your terminal. If the file is JSON, it formats and indents the output automatically. Refuses when output is piped or captured (for example by an AI agent's shell tool) unless you pass --force-stdout.

Permanently decrypts the vault, restores plaintext secrets back to disk, and moves the encrypted vault to soft-deleted trash to prevent accidental data loss.

Displays environment diagnostics: Apple Silicon Secure Enclave master key configuration, Zero-Cache session state, current project vault path, and total indexed vaults.

Audits and catalogs all locked vaults across your Mac grouped by directory. Displays target files, encrypted vault sizes, decoy statuses, and last modified dates.

Fast shorthand to recursively crawl folders and register all existing .vault files into the centralized macOS status registry without manual navigation.

Creates immutable, versioned backup snapshots in ~/.sec/backups/. Lets you edit credentials fearlessly, knowing you can roll back to any prior version.

Rolls back the current project's vault to a previous version snapshot. Synchronizes both the encrypted vault file and the on-disk masked decoy placeholder. Version numbers only match this project's snapshots; a snapshot ID from sec backup --list can name any vault.

Manages soft-deleted vaults. When vaults are unlocked or removed from disk, they are automatically placed into the trash bin to prevent accidental credential loss.

Exports your base64 master hardware recovery key. Store it securely in your password manager (e.g. 1Password) for disaster recovery or when migrating to a new Mac.

Imports your master recovery key onto a new or wiped Mac, allowing all your existing .vault repositories to be unlocked with Touch ID immediately.

Inspects or clears the biometric grace-period session. In strict Zero-Cache mode (default) nothing is cached, so every command requires a fresh physical Touch ID tap and clear has nothing to flush.

Immediately locks your biometric session state, requiring a physical Touch ID tap on the next CLI command or GUI action.

Installs macOS Finder Quick Actions into ~/Library/Services/. Allows you to right-click any .env or .vault in Finder to Lock, Unlock, Edit, or View secrets with native macOS notification banners.