Stop committing .env files to Git.
A 6.3 MB, zero-account Micro-KMS written in pure Rust. Boots in 15 milliseconds, locks memory against kernel swap leaks, and transparently encrypts its volume with AES-256-GCM.
docker run -d -p 8443:8443 -v vault-data:/data oakai/sovereign-vault
Quickstart →
Core Pillars
Why developers replace bloated vault stacks with Sovereign Vault
Fast as Fuck (Pure Rust)
Compiled to a single 6.3 MB static binary. Zero garbage collection pauses, microsecond response times, and uses less than 15 MB of RAM under load.
Zero Accounts & Zero Databases
No mandatory Postgres, Redis, or multi-tenant web signup wizards. It runs as an autonomous, self-contained container with embedded encrypted SQLite storage.
Memory-Safe Enclave
Uses mlock() to legally forbid the OS kernel from paging secrets to unencrypted swap disks. Memory buffers are zeroed on drop via zeroize.
Path-Scoped Machine Tokens
Issue scoped tokens (apps/api/*). If an attacker breaches a microservice via RCE, they cannot read your router or database secrets.
Anti-Hijack Nonce Guard
The daemon emits a single-use 64-character token strictly to standard output on first boot. Attackers scanning newly opened ports get 403 Forbidden.
AI Agent Native
Includes ready-to-use MCP tools and prompt specifications for Cursor, Claude Code, GitHub Copilot, and custom autonomous agents. One-click "Copy for Agent" exports clean Markdown documentation.
Head-to-Head
How Sovereign Vault compares to other tools
| Capability | Sovereign Vault | HashiCorp Vault | Infisical | Plain .env in Git |
|---|---|---|---|---|
| Container Footprint | 6.3 MB | 280 MB+ | 300 MB+ (3 containers) | 0 MB |
| RAM Utilization | < 15 MB | 500 MB – 1.5 GB | 400 MB+ | 0 MB |
| Account Setup Required | ❌ None (Zero-account) | Complex IAM/Token | ⚠️ Mandatory Web UI Signup | ❌ None |
| Database Dependencies | None (Embedded SQLite) | Consul / Raft | PostgreSQL + Redis | None |
| Swap Page Leak Protection | ✅ mlock() Pinned | ✅ Enabled | ❌ No (Node/Go GC) | ❌ Plaintext on Disk |
| Physical Volume Encryption | ✅ AES-256-GCM AEAD | ✅ Storage Barrier | ⚠️ DB Table Level | ❌ Plaintext File |
Research & Teardowns
Technical Whitepapers
The $90,000 Git Leak Nightmare
The mechanics of secret compromise: How GitHub scanning bots weaponize committed OpenAI & AWS API keys in under 4 minutes.
Engineering #01The RAM Swap Memory Trap
Why standard secret managers leak master keys to unencrypted swap partitions, and how we solved it in Rust using mlock() and zeroize.
Forensics #05Case Studies in Secret Leakage
Forensic analysis of major historical breaches: Dissecting Uber's AWS token, CircleCI, and Toyota's 5-year public GitHub exposure.
Ready to eliminate .env credential leaks?
Spin up the single-binary container on Docker in 15 seconds. No registration required.