The Eureka DatabaseDeveloper ToolsEncrypted Secret File Manager
Concept Preview · Interactive Mockup
Toastv0.4 · preview
Encrypted Secret File Manager
DR
Transparent file-level encryption

Your secrets, encrypted at rest.
Invisible to your workflow.

Mark .env, kubeconfigs, cloud credentials, and SSH keys as protected. Toast keeps them encrypted on disk and decrypts on read for the tools you trust — without changing how you build.

Demo preview · no real encryption performed
live
5
Protected files
live
1284
Access events / 24h
live
7
Keys rotated this wk
live
1
Policy violations

Protected files

Encrypted at rest · decrypted in-memory for trusted processes

File
Algorithm
Size
Last access
  • .env.production
    ~/projects/orbital-api/
    Encrypted
    AES-256-GCM
    4.2 KB
    2 min ago
  • ~/.kube/config
    /Users/dana/.kube/
    Encrypted
    AES-256-GCM
    12.1 KB
    14 min ago
  • aws_credentials
    ~/.aws/
    Encrypted
    ChaCha20-Poly1305
    1.8 KB
    1 hr ago
  • id_rsa
    ~/.ssh/
    Encrypted
    AES-256-GCM
    3.4 KB
    3 hr ago
  • gcp-service-account.json
    ~/secrets/
    Rotating key
    AES-256-GCM
    2.6 KB
    yesterday
  • .env.local
    ~/projects/landing/
    Action needed
    Unprotected
    1.1 KB
    5 min ago
Showing 6 of 6 protected files

Recent access

Live audit trail · last 24 hours

  • vscode (PID 8421) decrypt-on-read
    14:32:08
    .env.production
  • terminal · dana@laptop read
    14:18:51
    ~/.kube/config
  • 1Password CLI rotated key
    13:54:12
    aws_credentials
  • system policy applied
    13:40:00
    team/platform
  • node (PID 1290) blocked – missing policy
    13:22:47
    .env.staging
  • gh actions runner read (CI scope)
    12:11:03
    deploy_key

Connected vaults

Source of truth for master keys

1Password
Personal · Engineering
HashiCorp Vault
acme-eng / kv-v2
AWS Secrets Manager
us-east-1 · prod
Bitwarden
Personal

CLI & IDE integration

Drop-in for the tools you already use

~/projects/orbital-api
$ toast protect .env.production→ wrapping key from 1Password (vault: Engineering)✓ encrypted .env.production (AES-256-GCM)$ toast status5 protected · 0 leaked · 1 need review$ toast run -- node server.js→ decrypted in-memory for PID 1290 (node)✓ process exited cleanly
VS CodeJetBrainsNeovimiTermWarpGitHub Actions

Team policy

acme-eng · 14 developers

Platform tier
Require encryption for .env*
Enforced across 12 repos
Block plaintext kubeconfigs
Auto-encrypt on detect
Rotate cloud credentials
Every 30 days · last: 6d ago
Allow personal vault override
Disabled by security
1 file needs review
.env.local don't match team policy.
Daemon healthy 0.4% CPU · 18 MB RAM Touch ID unlocked · 3h 42mbuild c4a91e2
Interactive demo concept · presented inside The Eureka Database