GUIDE
Vault in your app
Read secrets over an attested channel instead of an env file.
What goes in
API keys, database credentials, SSH keys and certificates, TLS private keys, OAuth and webhook secrets, signing keys, cloud credentials, and whole .env files as structured config. One entry is one item, or one schema-validated group.
Nobody at ForgeZero can read it
The master seed is split across custodians and never written to disk. Reconstructing it takes a quorum, and each custodian share is sealed twice — once under their passkey, once under their recovery phrase — so losing either factor is survivable and losing both is not.
Cutting access in a hurry
Blocking is not locking. A block refuses reads immediately and lifts just as fast, scoped to one entry, one project, or everything. Locking drops the seed and needs a custodian quorum to undo — right for a suspected compromise, wrong for pausing a project for an hour.