SecureVault
A self-hosted credential vault with a Rust core — in development, not yet released
Status first
SecureVault is not released. The Rust core is solid and fully tested; the desktop and browser clients are experimental; the external security audit has not happened yet. We are saying that plainly, because a credential vault is the last category where a vendor should be vague about maturity.
What it is
A password and secrets manager you host yourself. Secrets are encrypted on your own machine by a local daemon bound to loopback only; desktop clients and a browser extension reach it over local IPC rather than a cloud round-trip. Encryption keys can optionally be backed by Azure Key Vault.
It also issues short-lived scoped grants to other Netrun components — which is the part in genuine daily use, as the credential source behind Charlotte's command line.
Design and current state
AES-256-GCM with a modern KDF
Argon2id at 152MB and 4 iterations, or PBKDF2 at 600,000 iterations, with HKDF-SHA512 key expansion.
Loopback-only daemon
An Axum service exposing 12 endpoints behind JWT auth and a 600 requests/minute limiter, bound to 127.0.0.1 — it is not reachable off the machine.
Local IPC, not cloud round-trips
Unix domain sockets on macOS and Linux, named pipes on Windows, speaking JSON-RPC 2.0.
Bring your existing vault
Imports from Bitwarden, 1Password and LastPass exports, plus generic CSV and JSON.
Short-lived scoped grants
A grants crate issues envelope-signed, policy-bound credentials. This is the piece in real daily use, backing Charlotte's vault commands.
Rust core tested; clients are not
The Rust backend passes its full suite. The Linux, macOS, Windows and browser clients are experimental and under-tested — we are not going to call them production.
Want to hear when SecureVault ships?
We will publish a release when the clients are tested and an external audit is complete. Get in touch and we will tell you when that happens.