secrets-vault 2.4.0

AES-256-GCM encrypted key-value vault with PBKDF2 key derivation. Store API keys and tokens securely instead of plaintext dotfiles.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!--
      REQUIRED for the biometric Keychain. Proven by elimination: a biometric
      SecAccessControl item fails SecItemAdd with errSecMissingEntitlement (-34018)
      without a keychain-access-group entitlement, on BOTH the legacy and
      data-protection keychains. (Gemini's "default group, no entitlement" claim is
      incorrect for biometric items.)

      The team-ID prefix (VLK8CVU5H3) makes this a PROFILE-FREE entitlement: a plain
      Developer ID signature satisfies it — no provisioning profile required. This
      is the only entitlement the CLI needs (no Apple approval, unlike ES/NE).
    -->
    <key>keychain-access-groups</key>
    <array>
        <string>VLK8CVU5H3.io.quantumencoding.secrets</string>
    </array>
</dict>
</plist>