Jitpass

🛡️ CyberSecurity Leader

[Jitpass @menitasa]

Building side projects is fun. Seeing them get real-world recognition is even better. 🚀

A few months ago, I started working on jit (by jitpass) a tool built to solve a very specific problem that’s been bothering me: How do we keep developer secrets local, safe, and out of plaintext .env files and shell histories, especially now that AI coding agents have full access to our machines?

The idea was simple: replace local secrets with decoys, keep the real values encrypted in a local macOS Keychain vault, and inject them into memory only when an authorized process runs (gated by Touch ID).

Fast forward to this week, and I’m super excited to see two amazing milestones for the project:

1️⃣ Featured on RuntimeWire: A deep-dive article covering how jitpass protects developer endpoints from exposure to local AI agents and shell exposure: 👉 https://t.co/6Lsn8VtWjc

2️⃣ Featured on GitHub Trending Weekly #45 (YouTube): Honored to be included among 30 trending open-source/developer projects! 👉 https://t.co/D5SXFoQtes (timestamp [10:39])

Building jit in Go has been a great journey, and seeing the cybersecurity & developer community engage with it makes it all worth it.

Check out the code & documentation on GitHub (and drop a ⭐️ if you find it useful!): 👉 https://t.co/fQt6SgvfSM

Would love to hear your thoughts, feedback, or how you currently manage local developer credentials! 👇

#CyberSecurity #Go #DevSecOps #AIAgents #MacSecurity #OpenSource #DeveloperTools #GitHubTrending

[Jitpass @menitasa]

Most developers still store live credentials in plaintext across their machines in .env files, AWS credential files, shell history, and more.

One compromised dependency or prompt-injected agent is all it takes to steal all your secrets.

I built jit to fix this without disrupting how we work.

It finds exposed secrets, moves the real values into a local vault gated by Touch ID, and replaces them with decoys.

Tools continue to function normally. Stolen data becomes useless.

No account. No telemetry. Fully local. Free for personal and internal use.

If this resonates, I’d love your feedback:

https://t.co/fQt6SgvfSM

#Cybersecurity #DevSecOps #DeveloperTools #SecretManagement #Infosec #Devops #MacOS

[Jitpass @menitasa]

Most developers still store live credentials in plaintext across their machines in .env files, AWS credential files, shell history, and more.

One compromised dependency or prompt-injected agent is all it takes.

I built jit to fix this without breaking the way we work.

It finds exposed secrets, moves the real values into a local vault gated by Touch ID, and replaces them with decoys.

Tools continue to function normally. Stolen data becomes useless.

No account. No telemetry. Fully local. Free for personal and internal use.

If this resonates, I’d love your feedback:

https://t.co/fQt6SgvNIk

#Cybersecurity #DevSecOps #DeveloperTools #SecretManagement #Infosec #Devops #MacOS

[Jitpass @menitasa]

I got tired of leaving live API keys in plaintext on my machine just waiting for the next compromised package or AI agent to grab them.

so I built jit.

it locks the real secrets away and leaves decoys. your tools still work. whatever gets scraped is garbage.

https://t.co/fQt6SgvNIk

[Jitpass @menitasa]

just ran jit scan on my mac and yeah… i had live secrets sitting in plaintext in like 4 different places

it moves the real ones behind touch id and leaves decoys so your tools keep working. whatever gets stolen is just garbage now

free, local, no account. this is actually kind of genius https://t.co/jDCyqFxBUy

[Jitpass @menitasa]

What if .env files and ~/.aws/credentials never sat in plaintext on your disk again?

​jit puts your local developer secrets behind Touch ID and serves decoys on disk. When your tools ask for credentials, they're injected just-in-time.

​Supply chain attack defense without adding friction to your terminal.
​Check it out: https://t.co/6nDuAwaN3K

👉 ​brew install jitpass/tap/jitpass

[Jitpass @menitasa]

We encrypted secrets in the cloud, in CI, in Kubernetes.

Then we left them in plaintext on the laptop: .env, ~/.aws/credentials, .npmrc, kubeconfig, MCP configs.

Anything running as you can read all of it. Including the AI agent in your editor, running with your full permissions.

So I built #jit.

It moves each secret into a local vault behind Touch ID and leaves a working decoy on disk. The real value shows up in memory, for the one process that asked, after you approve it.

Your commands don't change. aws s3 ls. terraform apply. gh pr list.

Three rules I won't break:
• Scan is read-only. No flag makes it write.
• Consent is per tool, not per session. When a postinstall script reaches for your AWS keys, you get a prompt naming it.
• Every change is reversible. jit migrate undo restores files byte for byte.

brew install jitpass/tap/jitpass, then jit scan. One second, changes nothing.

#macOS (#Apple #Silicon) #devsecops #cybersecurity #security #ciso #api #Kubernetes #docker #k8 #cli #linux
https://t.co/jDCyqFx450

[hiroppy | iiba @about_hiroppy]

.env、.npmrc、AWS credentials、MCP 設定などに残る平文シークレットを検出し、Touch ID で保護されたローカル暗号化 vault に移す jit が公開

jitpass/jit: Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first. https://t.co/wL2QPsYufQ

[Jitpass @menitasa]

@mizchi @about_hiroppy Why do you think that? :) I will tell you the truth: I kind of like it .

[Jitpass @menitasa]

jit 0.99.1 names it:

An "unidentified reader" kept touching every decoy .env on my Mac, 13 files in one minute. jit 0.99.1 can now tell you who:

○ opened by an unidentified reader, nothing read ×7
└ likely com[.]apple.Virtualization.VirtualMachine, which read a sibling mount at 16:42

Empty touches don't count as reads anymore either.

https://t.co/jDCyqFx450

[Jitpass @menitasa]

jit 0.99 is out, and it's a big one 🔥

1Password user? Migrate now: LINKS your secrets (op://), no copies.

Nervous? --dry-run shows every move before it touches a file.

And the service can't stay dead anymore: any jit command resurrects it.

brew install jitpass/tap/jitpass 🚀🚀🚀

https://t.co/fQt6SgvfSM

[Jitpass @menitasa]

jit v0.97.0: 1Password support.

If a value in your .env already lives in 1Password, jit migrate now stores the op:// reference instead of a copy. Rotate in 1Password

jit follows. Decoys, per-process consent, and audit all still apply.

brew install jitpass/tap/jitpass
#1Password #SecretsManagement #DevSecOps #InfoSec #CyberSecurity #DevTools #macOS #CLI #AppSec #Developers

https://t.co/fQt6SgvfSM

[Jitpass @menitasa]

@kidtsang Can't agree more. 🫡

[Jitpass @menitasa]

We encrypted secrets in the cloud, in CI, in Kubernetes.

Then we left them in plaintext on the laptop: .env, ~/.aws/credentials, .npmrc, kubeconfig, MCP configs.

Anything running as you can read all of it. Including the AI agent in your editor, running with your full permissions.

So I built #jit.

It moves each secret into a local vault behind Touch ID and leaves a working decoy on disk. The real value shows up in memory, for the one process that asked, after you approve it.

Your commands don't change. aws s3 ls. terraform apply. gh pr list.

Three rules I won't break:
• Scan is read-only. No flag makes it write.
• Consent is per tool, not per session. When a postinstall script reaches for your AWS keys, you get a prompt naming it.
• Every change is reversible. jit migrate undo restores files byte for byte.

brew install jitpass/tap/jitpass, then jit scan. One second, changes nothing.

#macOS (#Apple #Silicon) #devsecops #cybersecurity #security #ciso #api #Kubernetes #docker #k8 #cli #linux
https://t.co/jDCyqFx450

[Jitpass @menitasa]

What's new in jit (v0.93):

🔍 jit vault duplicates: finds vault entries that are copies of the same file, compares the real decrypted values in memory, and tells you exactly which copy is safe to retire and with which command. --prune deletes only provably dead copies.

🗑️ jit vault rm <group>: delete a whole group of secrets at once. Every path is listed before you confirm, one Touch ID for the lot.

📁 Deleted a project folder without unmounting first? jit vault orphans --prune now recovers everything in one command: the leftover secrets and the stale mount registration.

🔑 jit grant --process is tree-scoped: grant once and every current and future session under your terminal is covered, including new tabs.

https://t.co/jDCyqFx450

[Jitpass @menitasa]

Everyone's asking how to stop an AI agent from exfiltrating your scripts keys.

Here's my answer, live from my terminal: the agent never gets them. Touch ID or nothing and an unattended process has no thumb.

Shipping this as #jit.
https://t.co/TL5RMnCSKV

[Jitpass @menitasa]

jit v0.85.0:

Claude Code, kubectl, aws, and friends keep working across upgrades.

jit doctor finds it; jit migrate &lt;file&gt; fixes it.

https://t.co/4wrTbm4BKx