Vault backs up your .env files, keys, certificates and Cloudflare secrets to iCloud Drive, encrypted. Wipe a Mac, set up a new one, and every project comes back exactly as it was.
Every file is sealed with ChaCha20-Poly1305 using a key only you have. Apple and anyone with access to your iCloud see ciphertext.
Values stay hidden until you reveal or copy them.
Nothing is overwritten. See what changed by name, never by value, and restore any version.
Save on two Macs before iCloud syncs and both versions are merged. Nothing is lost.
Cloudflare only returns secret names. Vault keeps the values and pushes them for you.
vault status catches the mistakes that leak secrets or break releases.
.env.production is committed to git.dev.vars is missing from .gitignoreExport to an encrypted disk image any Mac can open. Or decrypt by hand: the format fits in six lines of Python.
Plus ~/.ssh, ~/.aws, GnuPG and age keys, and your App Store Connect API keys. Templates and node_modules are skipped.
Folders don't have to match the old Mac. Vault finds repos you already cloned by their git remote.
Let iCloud Drive sync your encrypted vault.
It's in Apple Passwords as “Vault master key”.
Open Vault, paste the key, and pick where projects go.
Home first, so ssh keys are in place. Then repos are cloned and their secret files written into them.
The vault command ships inside the app, so it updates with it. Script it, or let the daily backup run on its own.
In your own iCloud Drive, in a folder called Vault. Every file is encrypted on your Mac before it's written there. There's no Develings server and no account to create.
Keep it in Apple Passwords, which syncs it to your other devices. A copy is also cached in your Mac's login keychain. If you lose the key and every Mac that has it, the vault can't be decrypted. That's the point.
Run vault key rotate. It re-encrypts the vault and its history with a new key. Update Apple Passwords and paste the new key on your other Macs.
Vault checks for new versions in the background and installs them when you quit. Every update is signed, and the app refuses anything that doesn't match the key it was built with.
Yes. vault export backup.dmg writes everything into an AES-256 encrypted disk image any Mac opens with a password. The file format is documented and simple enough to decrypt by hand.