Crunu release history

The product now has its public name, Crunu.

Renamed

• The agent command is crunu, and its service and Debian package are crunu-agent.
• Environment variables start with CRUNU_, and tokens start with crunu_. Service tokens, for example, start with crunu_svc_.
• HTTP headers use the X-Crunu- prefix, and metrics use crunu_.
• The agent's files live under /etc/crunu, /var/lib/crunu and ~/.config/crunu.

Breaking changes

Fixed

• Several server instances starting at the same time on Postgres no longer fail while creating internal tables.

Environments can now be limited to the networks you trust. The server delivers their contents only to requests from allowed IPv4 and IPv6 ranges.

Network rules

• Network lists and environment network policies are signed documents with a full version history.
• Tightening a policy applies immediately.
• Relaxing a policy takes effect after 15 minutes, with an alert and an option to cancel. A second signature applies it at once.
• A change to a policy or a network list can be rolled back to the version in force within the past day.
• A machine whose address changes keeps access for a grace period, 24 hours by default.
• Owners can open break-glass access for up to 60 minutes. It requires a reason and a second factor, and it raises an alert.
• Network-restricted environments can forbid share links entirely, or accept service tokens only with a CI binding.
• Network-restricted environments are left out of offline copies and exports.

Alerts

• New alerts for a relaxed policy, a quick rollback, break-glass access, denials, an unknown client address, access through a machine pass from a new address, and a pass used twice.

Agent

• A new exit code, 7, means an environment's contents aren't delivered to this address. A denial for one environment doesn't stop the others.
• The status command shows the machine's pass and the address the server sees.
• The agent and the installer explain clearly when a system has no trusted root certificates. The Debian package now depends on ca-certificates.

Operators

• Behind Cloudflare, the server trusts the client address header only on requests that come from Cloudflare's own networks. The diagnostics tool checks that client addresses are detected correctly.

The first release of the platform Crunu runs on today. Values are encrypted and decrypted only in the browser and in the agent. The server stores ciphertext, public keys and signed records, and it has no decryption key at any point.

Accounts and sign-in

• Your account key is derived from your password and a Secret Key generated on your device. Neither one is sent to the server.
• A printable Emergency Kit holds your Secret Key and a QR code for setting up a new device.
• Second factor with authenticator apps or with passkeys and security keys.
• Approve a new device from one that's already signed in by comparing a six-digit code.
• Optional personal recovery code. Access returns after a waiting period, one hour by default, and the account owner is alerted.
• Changing your password, replacing all account keys after a device is compromised, and deleting your account all require your current password and Secret Key.
• The app locks after a period of inactivity, and copied values are cleared from the clipboard after a minute.

Teams and access

• Organizations with owners, admins and members. One account can belong to several organizations.
• Roles on each environment: Editor reads and changes all files, Reader reads them, Specific files sees only the files chosen for that person, and Operator adds machines and requests access for them without seeing any values.
• Invitations are valid for up to seven days. The new member verifies a key fingerprint with an admin, who then confirms them.
• Access profiles group environment roles under one name, so a change to the profile applies to everyone in it.
• Members can send access requests, and owners or admins approve or reject them.
• Offboarding in one flow: an exposure report of the versions the person received, a reissue checklist of the values to change at their providers, revocation of the tokens, links and codes they could still use, and rotation of their environment keys.
• When an admin leaves, the organization keys are rotated to a new key generation.
• Employee recovery: an admin can transfer the personal environments of a lost account to that person's new account.

Projects, environments and history

• Projects hold environments, and every environment has its own key.
• Store .env files, INI files such as ~/.aws/credentials, flat YAML or any text. Drag in files and whole folders.
• History keeps the last 100 versions of each environment. View and compare versions, and restore an old one as a new version.
• Compare two environments and copy selected values from one to the other.
• Search with ⌘K across names, services, paths and actions. Values are never searched.
• Every member has a personal project for their own secrets.

Machines and CI

• An agent for Linux and macOS on amd64 and arm64.
• Machines enroll with a single-use enrollment code, and an admin approves each one after verifying its fingerprint.
• On Linux, a systemd service keeps decrypted environments in memory only and hands them to local programs over a socket that only its group can use.
• Machines keep working without a connection until their lease ends, 24 hours by default. Revocation wipes environments from memory.
• Commands to run a program with an environment's variables and to write an environment's files to disk with restricted permissions.
• Service tokens for CI, limited to specific environments, with a lease, a usage limit and optional network restrictions.
• A CI binding ties a token to GitHub Actions, GitLab CI, Bitbucket Pipelines or any OIDC issuer, down to the repository, branch and deployment environment.
• An install script that checks SHA-256 sums, Debian packages and signed self-update.

Sharing

• Share links give people without an account the files you choose from an environment. The decryption key stays in the part of the link after #, which never reaches the server.
• Expiring links stop working after a set time of up to 365 days or after a set number of views, which can be just one. Live links show the latest version of the files until you revoke them. Links can also require a password.

Audit log and alerts

• The organization audit log is a hash chain with one-click verification and JSONL export. It is kept for 365 days by default.
• Alerts appear in the app and can be sent to notification channels: a signed webhook or email.

Running the server

• One server for Docker on your own machine, Cloudflare Workers with D1, Vercel, Google Cloud Run and AWS App Runner. The App Runner script works only in AWS accounts where App Runner is still offered.
• Storage on SQLite, Postgres or Cloudflare D1.
• Move between platforms with a single export archive that contains no readable values.
• Signed releases of the agent and the web app, a reproducible web build, and a standalone HTML copy of the app that checks the hosted site against the signed release.
• A health check, metrics and a diagnostics tool for operators.