Secure Saver

The problem

Teams pass .env files and API keys around in chat and notes, in plaintext, with no audit trail.

The solution

Secure Saver is a private, Keep-style workspace for environment files, passwords, API keys and certificates. The API encrypts every secret with AES-256-GCM before it reaches PostgreSQL. The browser never receives the master key and never stores decrypted values.

Highlights

• AES-256-GCM encryption in the API, so the database only ever holds ciphertext
• Short-lived JWT access tokens kept in memory, with rotating, revocable HttpOnly refresh cookies
• Argon2id password hashing, Zod validation, Helmet hardening and parameterized SQL
• RBAC and an audit log. Admins can manage accounts without seeing anyone else's secrets
• CI/CD: GitHub Actions runs typecheck, tests and build, then deploys over SSH with Docker Compose