keygrant now syncs your agent secrets across machines, without the server ever being able to read them.
Values are encrypted on your device with a key derived from your password plus a 128-bit Secret Key. The server stores ciphertext and relays; it can't decrypt.
@TellusCoop both stdout and stderr get scrubbed before the model sees them — the exact value plus its base64/hex/url-encoded forms. honest gap: a tool that writes the value into a *file* the agent later reads is outside keygrant's view. redaction is the second line, not the boundary itself
If your coding agent can read your API key, every output channel it has can leak it: replies, generated code, tool calls, URLs.
I built keygrant: the model sees the secret's name, the child process gets the value. Every use needs your approval.
@Joshua_WD skipped it ourselves for exactly one release — 0.1.2 grants were per-session, caught it before promoting, 0.1.3 shipped the fix. the uncomfortable part of building security tools is your own changelog
@Joshua_WD exactly — it's the same split your shell has used for fifty years. the part that took actual work: making approval per-command and in-memory, so one "yes" doesn't become a 15-minute blank check for whatever the agent tries next
Your winning ad doesn't have to be a one-hit wonder.
Recast the avatar. Swap the product. Change the scene.
Keep the motion that converts. 1 proven video → a month of campaigns.
Ad Remix, live now → https://t.co/WYF1NWRbbZ