Security \| Ghostable

Project security

 Your project’s secrets. Encrypted before Git.
===============================================

 Ghostable encrypts your ENV values locally. Your repository holds the encrypted data; the private keys stay on the devices you authorize.

No account. No hosted secrets service.

 A repository clone is not secret access.
------------------------------------------

### In your project

 Encrypted values, public keys, and signed access records. Public keys let your team share access and verify changes—they cannot decrypt your secrets.

### On your device

 Your project’s private keys, kept outside Git in the OS credential store or a local identity file with restrictive permissions. Never in the project’s `.ghostable/` directory.

### Access is explicit.

 Each device needs a grant for each environment. That grant is encrypted to its public key and opened with its private key. Access to staging does not grant access to production.

 Values are encrypted; names and history are readable. Keep secrets out of metadata and commit messages.

When secrets are in use.
------------------------

 After decryption, your application or runner can read the values. Protect those systems, review changes, and rotate exposed credentials. Removing access cannot erase a secret someone has already read.

Frequently asked questions
--------------------------

    Can I commit my .env file?

Not if it contains plaintext secrets. Commit the encrypted records in .ghostable/ instead. Keep local .env files, private identities, and automation tokens out of Git.

    Can someone with repository access read my secrets?

A repository clone alone cannot decrypt your values. It contains encrypted data and public records, not the private identity or automation credential needed to unlock them. Names and history remain readable.

    Does Ghostable receive my secret values?

There is no Ghostable-hosted secrets service receiving your values. The app encrypts and decrypts locally. When you reveal, export, or deploy a value, the local app or destination you choose can read it.

    How does CI get access?

Use a dedicated automation credential with only the environment grants the job needs. Store it in your CI platform’s secret store, never in the repository. Do not copy your personal device identity into CI.

    What happens if I lose a device?

Use another owner device to revoke its access. Rotate any underlying credentials that may have been exposed. Keep more than one owner device: if all authorized private identities and automation credentials are lost, Git cannot reconstruct them.

   [Security model   ](https://ghostable.dev/docs/3.x/reference/security) [Project file reference   ](https://ghostable.dev/docs/3.x/workflows/projects)

 [Report a vulnerability](https://ghostable.dev/security/report)