SecRefs expands declarative sec:// URIs directly in memory, at runtime. No plaintext secret is ever written to disk, logged, or sent to a third-party SaaS vault - because there is no third party.
Every plaintext secret that leaves your vault - into a `.env` file, a CI variable, a teammate's clipboard - is a copy you now have to track, rotate, and eventually leak. SecRefs replaces the copy with a pointer.
Put sec://aws/prod/db#password in .env instead of the plaintext password. It's safe to commit.
secrefs run -- node server.js intercepts your environment before your app boots.
Every sec:// value is fetched from its real vault concurrently, entirely in the CLI's memory.
The child process inherits a fully-hydrated environment. Nothing was ever written to disk.
Paste a mock .env, pick which lines are mock provider secrets, and watch SecRefs validate and expand them entirely in your browser's memory. Nothing here ever leaves your machine - there's no backend behind this sandbox.
Hit Expand to simulate resolving every sec:// reference above.
sec://aws/...Ambient AWS credentials or an IAM role - never a static key in your config.
sec://vault/...KV v1 & v2, authenticated via VAULT_ADDR / VAULT_TOKEN already in your environment.
sec://local/...A gitignored .secrefs.local.json for teammates who don't have vault access yet.