Someone deletes a variable, production crashes, and nobody knows what the old value was. Never again.
Real incidents, real post-mortems. Every one of them is a missing diff.
A Redis connection string changed without review at 3:52 PM. By 5 PM, 4,000 users were logged out.
The diff would have shown exactly who changed it and what the old value was.
Checkout pods returned 502s after a node rotation. The env var existed only on the replaced nodes, set once via a console, never written down.
The history would have had the value. One click restores it.
The variable existed on the developer machine but never made it to production. Tests, review, and build all passed. Production found it.
Startup validation against the contract catches it before deploy, not after.
Three steps. The product does the remembering so you don't have to.
Paste or upload your file. Keys are parsed, values masked on sight. Your first diff appears in under a minute.
Edit a value and a commit entry appears with your name, a timestamp, and the diff. Nothing is ever overwritten.
Pick any version and confirm exactly which keys will change. The rollback appends a new version, so undoing the rollback is one more click.
The features that matter when it is 2am and checkout is down.
Vercel shows who changed what but hides the before/after behind Enterprise. Here every change shows its diff, on every plan.
Dev and staging get an undo toast. Production gets a confirm dialog listing exactly which keys change. Never the other way around.
Values render as bullets. Reveal is click-only, never hover, and every reveal is an audited read event.
Copied secrets clear from the clipboard automatically. Nothing lingers to be pasted into the wrong chat.
Every read and write lands in the log: who, when, what changed. Values never appear in the records.
Push the current version straight to your Vercel project. No more console copy-paste.
Storing secrets is the highest-trust ask in software. Here is exactly what we do with yours.
Server-side encryption at rest. Values are decrypted in memory only and discarded when the viewer closes.Honest limit: v1 uses platform-managed encryption. Per-project keys are on the roadmap.
Values never appear in logs, audit records, or error responses. The log records the fact of access, never the secret.
Reveal and copy are treated as audited read events: who, when, from where.
Reads and writes go through membership checks on every route. There is no unauthenticated path to a value.
We do not charge per seat like Doppler ($21/user/mo) or per identity like Infisical ($18/identity/mo).