> HASP
A local secret broker that securely manages and delivers secrets to applications and coding agents within project boundaries.
[ screenshots ]
[ about ]
HASP is a local secret broker designed to securely manage and deliver secrets to applications and coding agents within defined project boundaries. It operates by storing secrets in an encrypted vault and providing them to connected applications and agents only when necessary, ensuring that secrets are never exposed in plaintext during runtime.
The core components of HASP include:
- Vault: An encrypted local store of named secrets under
HASP_HOME, utilizing Argon2id with memory-hard parameters for robust security. - Apps: Applications connected to the vault, which can access secrets through environment variables, temporary files, or temporary dotenv files outside the repository.
- Agents: Coding agents connected to the vault, which operate through HASP to access secrets without direct exposure.
HASP emphasizes a local-first, end-to-end approach, operating without the need for accounts or control planes, and ensuring that telemetry remains off unless explicitly opted in. It is designed to work in various environments, including isolated networks and secure facilities, providing a source-available critical path with signed releases and Software Bill of Materials (SBOM) for transparency.