How Crunu keeps team secrets

Crunu keeps your team's .env files, cloud credentials and API keys in one place, without asking you to trust the server. Encryption happens only in the browser and in the crunu agent. The server stores ciphertext, public keys and signed documents, and it can't decrypt a single value.

The idea in one picture

• People use the web app at app.crunu.com. Each person has their own keys, derived from a password and a Secret Key that never leave their devices.
• Servers run the crunu agent. Each machine has its own keys and gets only the environments granted to it.
• CI pipelines use service tokens, each limited to the environments a job needs, and optionally bound to one repository and branch.
• The server keeps encrypted contents and decides whom to send them to. It never holds a key that could decrypt them.

How secrets are organized

An organization is your team. It contains projects, one per application or service, and each project contains environments such as development, staging and production. Every environment is encrypted with its own key, so access to development gives no access to production.

Inside an environment you keep files: .env files, INI files such as ~/.aws/credentials, YAML or plain text, each with the path where it belongs on a computer. Every save creates a new version, and the latest 100 are kept.

See Organizations, projects and environments.

What you can do with it

• Give each person exactly their environments. Organization roles are Owner, Admin and Member. Environment roles are Editor, Reader, Specific files and Operator. Access profiles grant a set of environments to many people at once, and members can request access when they need more.
• Deliver secrets to servers with the agent. crunu run starts your program with its variables in memory, and crunu pull writes files with safe permissions. A machine keeps working offline until its lease ends.
• Keep production out of CI. A token for staging never gets the key of production. A CI binding makes a leaked token useless outside its pipeline.
• Share a file with someone who has no account through a share link with an expiry, a view limit and a password.
• Offboard someone properly. When a person leaves, Crunu removes their access, rotates the keys of every environment they had, shows what they received, and lists the values to reissue at their providers.
• Restrict production to known networks, with signed rules and a delay before any rule gets looser.
• See what happened. The audit log is a hash chain you can verify in one click and export.

What Crunu doesn't do

Some limits come with the design, and it's better to know them up front:

• It can't take back what someone already saw. Revocation and key rotation protect new versions. Values a person or machine already received must be reissued at their providers.
• The server sees metadata: names of projects, environments and machines, email addresses, the audit log, and the sizes and times of versions.
• No dynamic secrets. Crunu stores and delivers secrets. It doesn't mint temporary database passwords, because that needs a key on the server.
• No Windows build and no mobile apps. The agent runs on Linux and macOS. The web app works in Chrome 113 or later, Safari 17 or later and Firefox 129 or later, including on narrow screens.

The full list is in Limitations.

Where it runs

You can use Crunu at app.crunu.com, or host the same server yourself on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and move between them with one archive. See Self-hosting.

Crunu is free during early access. See Pricing.

Next steps

1. Create your account.
2. Create your first project.
3. Invite your team.
4. Install the agent on a server.
5. Connect your CI.