ENVPEMJWKSAny runtime

Keys that never touch git.

Envelope-encrypted vault for any stack. CLI injects at runtime. Signing keys, JWKS, dotenv, yaml — one audited surface.

GCM envelope

Run · Pull

Every reveal

Terminal · hylsa run

$ hylsa pull
  wrote .env.local (0600)
  wrote keys/jwt.pem (0600)

$ hylsa run -- python app.py
  injected 14 env vars
  wiped temp files on exit