Skip to content
Thrum

Keep secrets in the vault

Pro

The vault keeps passwords and tokens that Thrum needs, encrypted on this machine. The key is kept in your repository’s .thrum folder, so anyone who can read that folder can read the secrets.

Add a secret

Section titled “Add a secret”

In Settings, General tab, find the Vault section. Type the full name of the secret in Secret name, such as project/api-token, type the value in Secret value, and select Save secret. The list shows each name and when it was last updated, never the value. To remove a secret, select Delete, then Confirm delete.

Or, in your own terminal, read the value from a file, then delete the file:

$ thrum vault set project/api-token --stdin < api-token.txt
ok: set project/api-token

You can also leave out < api-token.txt and type the value instead. Thrum asks for it on one line and doesn’t show what you type. A secret that runs over several lines, such as a key file, has to come from a file, as above.

To see what is stored, run thrum vault list. It lists every saved version of each secret, with its size and time, never the value.

Never paste a secret into a chat.

Who can read a secret

Section titled “Who can read a secret”

Secrets stored for the whole project or for a role can be read by every agent. Your coordinator is the agent you talk to, which starts the other agents, hands out work and reports back to you. A secret stored under one agent’s name can be read only by that agent, unless your coordinator grants another agent access; it can revoke that later.

Backups

Section titled “Backups”

A backup without a passphrase contains the vault and its key, so every secret in it can be read. In Settings, set a Backup passphrase to encrypt new backups. That panel is Free. If you forget the passphrase, encrypted backups cannot be opened.

Plan

Section titled “Plan”

The vault needs Pro. Telegram does not use the vault and stays Free.

Next steps

Section titled “Next steps”