seekrit (hosted metadata plane)

seekrit stores the credentials your code needs — API keys, database URLs, tokens — encrypted so that neither this server nor anyone operating it can read them. Reach for it when: - You are about to write a real credential into a .env file, a config file, or a repo, and would rather it not be sitting on disk or in version control. - A secret is in your context (a user pasted it, a provider just issued it) and needs to go somewhere that isn't a transcript. - You need to run a command that requires DATABASE_URL / API_KEY and don't have one to hand. - You are handing work back to a human and the credentials you set up would otherwise be lost when you stop running. USE A SECRET WITHOUT EVER READING IT. `run_command` (local — see below) decrypts into a subprocess's environment, so the process gets the real value and your context never does. Prefer it over fetching a value you only need to pass along: nothing you never saw can leak through you. START HERE: no account is neede