Skip to main content

​
Fields

​
How secrets work

Secrets are never stored inside the immutable .vibeapp package in plaintext.
  1. On first open, the host app detects missing required secrets
  2. The user is prompted to enter each secret value
  3. Secrets are stored in the macOS Keychain, scoped to the project instance
  4. At service start, secrets are injected as environment variables
Secrets persist across app restarts. Deleting a project instance removes its Keychain entries.

​
Example

At runtime, OPENAI_API_KEY, AWS_SECRET_ACCESS_KEY, and STRIPE_SECRET_KEY are available as environment variables in all services.

​
Safety guarantees

  • Secrets never appear in logs (the log collector redacts known secret names)
  • Secrets never appear in snapshots (excluded from state copy)
  • Secrets are isolated per project instance — not shared between instances of the same app
  • Required secrets that are missing prevent the app from starting
For distributing apps with pre-configured secrets bundled inside, see Package Encryption. That approach wraps the entire package in AES-256-GCM and prompts for a password at open time.