Rookery
A local, encrypted vault for developer secrets, passwords and sensitive documents, built to keep plaintext secrets out of project folders.
A vault that lives on your own machine, with a command-line tool called rook. It keeps API keys, passwords and documents encrypted in one place, and hands them to your programs when they run, so they never sit in a .env file or a project folder. In development.
Tech stack
- Go
- Argon2id
- XChaCha20-Poly1305
- memguard
- Windows DPAPI
- GitHub Actions
- staticcheck
- gosec
- govulncheck
What it does
- The rook command adds, gets, lists, moves, removes and generates secrets, copying them by default rather than printing them
- Nests: sub-vaults, each with its own key. The personal nest can never be shared.
- rook run starts a program with its secrets as environment variables, so no .env file is written to disk
- A recovery key, password changes, and a full re-key if anything leaks
- The last five versions of each item, a 30-day trash and encrypted rotating backups
- A master password strength check, plus a password and passphrase generator
How it works
- Argon2id turns the password into a key, XChaCha20-Poly1305 encrypts the data, and memguard protects secrets while they're in memory.
- On Windows, DPAPI and owner-only file permissions add another layer.
- It notices an older copy of the vault being swapped in, pads data so its size gives nothing away, and keeps copied secrets out of clipboard history and cloud sync.
- Every change is tested on Windows and Linux, with a race check, fuzzing and three security scanners.
Planned next
- A background agent you unlock once, rook:// references and per-project approvals
- A desktop app, Windows Hello unlock, and a VS Code and Cursor extension
- Signed releases, then a small MCP server so AI agents can use secrets without seeing them
- Shared team nests, with MFA and approvals