A place for each team.
Organize secrets in vaults. Grant access to users or teams, with separate permissions to reveal and export values.
SELF-HOSTED SECRETS WORKSPACE
For your secrets.
And your peace
of mind.
Environment variables belong in a workspace you control. Encrypt them, give your team deliberate access, and get back to building.
Your infrastructure. Your keys. No hosted account required.
A closer look
FIG. 01 / YOUR SECRETS, SEALED Access is always explicit.
AES-256-GCM encryptionExplicit vault grantsValue-free audit trailBuilt to self-host
A HOME FOR THE IMPORTANT THINGS
All in its place.
Nothing left exposed.
The clarity of a workspace. The care of a vault. Take a look around this fictional example.
rune / workspaceFICTIONAL PREVIEW
Backend secrets
Three secrets. One deliberate boundary.
| KEY | VALUE | STATUS |
|---|---|---|
| DATABASE_URL | •••••••••••• | Active |
| API_TOKEN | •••••••••••• | Active |
| APP_ENV | •••••••••••• | Active |
Values stay hidden until you choose.Editor · Reveal allowed
Select a vault or reveal a fictional sample.
A clear trail.Actions recorded. Values excluded.
FIG. 02 / A LITTLE ORDER GOES A LONG WAYSample data only. Nothing here connects to a real vault.
A QUIETER WAY TO WORK
Less secret sprawl.
More clarity.
You should know where a secret lives, who can use it, and what changed. Rune keeps those everyday decisions close at hand.
Hidden until you need them.
Names and values are encrypted in storage. Reveal is deliberate and short-lived. Lists and activity keep values out of view.
Bring your existing workflow.
Review an .env import, pair values with an example template, or inject secrets into a process without creating a plaintext file.
FROM FILE TO WORKFLOW
A little structure.
A lot less guessing.
Explore a simple example. These are illustrations, with no connection to a real vault.
DATABASE_URL••••••••••ReadyAPI_TOKEN••••••••••ReadySERVICE_KEY••••••••••ReadyReview names and collisions. Save only when you’re ready.
Backend teamEditor
Reveal valuesExplicitly granted
Export valuesExplicitly granted
Workspace membership alone never grants secret access.
$ rune run --vault <id> -- node app.js
Vault access checked.
Active values supplied to the child process.
No plaintext .env file required. Nothing is running here.
LEAVE A TRAIL. KEEP THE SECRET.
Know what happened.
Keep values out of it.
A reveal, a rotation, a change in access. Rune records the action in a verifiable chain, while the secret value stays out of the history.
Illustrative hashes · Secret values never enter the audit trail
ON YOUR TERMS
Self-hosted.
From the start.
- 01 / HOSTYour infrastructure.
Run your workspace with PostgreSQL and Next.js.
- 02 / PROTECTYour keys stay yours.
Keep encrypted backups and rotate the master key offline.
- 03 / OPERATEA clear trail.
Verify audit history and explicitly deliver values to GitHub or GitLab.
MAKE IT YOUR WORKSPACE
Keep the secrets.
Lose the sprawl.
Use Node.js 22.13+, pnpm, and PostgreSQL 16. Configure your instance’s keys and credentials privately, then start Rune.
Use TLS before exposing your instance beyond a trusted local network.
- 01Configure privately.
Create your instance’s credentials and protect its master key.
- 02Bring up your workspace.
Start PostgreSQL and Rune. Use TLS for remote access.
- 03Make the first vault.
Grant access deliberately, then add your secrets.
This public site never asks for credentials or connects to your vault.
Open your configured workspace