What is a secrets vault?

A secrets vault is a service that keeps a team's credentials and sensitive configuration in one place, encrypted, and hands each person, server or pipeline only the values it is allowed to read, while recording who received what.

What a vault usually does

Most products in this category cover the same core jobs:

• Storage. Values are encrypted at rest and grouped by application and stage, such as development and production.
• Access control. People, servers and CI jobs get different rights. Production is usually the most restricted.
• Delivery. A command-line tool, agent or integration puts values into a running program, typically as environment variables or files.
• History. Earlier versions can be viewed and restored.
• Audit. An audit log records reads, changes and grants.

The OWASP Secrets Management Cheat Sheet recommends centralizing secrets this way so that each value has a known owner, purpose and location.

Where vaults differ

The biggest design difference is who can decrypt. In some designs the server holds the keys and decrypts on request. That allows features like generating database passwords on the fly, but it means the server, its operators and anyone who compromises it can read every value. In other designs encryption happens only on users' devices, and the server stores ciphertext it cannot read. That narrows what a server breach exposes but rules out server-side features that need plaintext.

Other differences that matter when choosing: where the server runs, how machines and CI authenticate, how access is removed when someone leaves, and whether the audit log can be checked for tampering.

How Crunu is built

Crunu is a team vault with a blind server. Encryption happens in the browser and in the crunu agent. The server stores ciphertext, public keys and signed documents and holds no key that decrypts a value. Access lists and every version are signed, so a compromised server cannot quietly add itself as a recipient.

You can use the hosted service at app.crunu.com or run the server yourself on Docker, Cloudflare Workers, Vercel or Google Cloud Run, and move between them with one archive. Projects contain environments, each with its own key. Machines run the agent with a lease, and CI uses service tokens that can be bound to a repository and branch with OIDC.

The trade-off is explicit: Crunu has no dynamic secrets, because they require keys on the server. The server also sees metadata, such as project and environment names, email addresses and the audit log. See what the server sees and the vault overview.

Sources

• OWASP Secrets Management Cheat Sheet, checked October 27, 2026.