Rezee- Chat
- Issues
- Code
- Docs
- ENG-42 Secrets
- Q3 Planning
- Architecture
Add encrypted pipeline secrets
Secrets should be encrypted at rest with a per-project key. The controller should decrypt them only inside the runner sandbox, so plain values never touch disk on the server.
Add a rezee secrets set CLI command and expose the values as masked environment variables during remote actions. Logs should redact anything that matches the secret value.
Rotate keys by re-encrypting the store with a new project key and restarting the controller. Runners pick up the new key on their next heartbeat.
We should also rotate the project key when a runner is decommissioned, otherwise old secrets stay decryptable.
Good call. I will add a key rotation command to the CLI and a runner attestation check before decryption.
Everything your team ships, in one place.
Code, issues, pipelines, chat, and docs — one workspace for your team and its agents.
FIG 0.1 · unified workspace