KeySentinel 🔐

KeySentinel is a lightweight, secure token encryption library and CLI tool for managing sensitive credentials with strong Zero Trust principles.

📖 Read the full article explaining the Two-Layer Security Architecture here

✨ Features

• 🔐 Two-layer token encryption: local symmetric key + vault storage
• 🚀 Developer-friendly CLI (keysentinel) with zero plaintext leakage
• 🔥 Predefined profiles for common APIs (AWS, GitHub, OpenAI, GCP, etc.)
• 🛡️ Extensible custom profiles via JSON
• 💩 Zero Trust Local Environment Enforcement
• 🗋 Secure clipboard copy with automatic timeout cleaning
• ❌ Export to plaintext files (.env, .json) intentionally blocked for safety

🚀 Why KeySentinel?

Most CLI tools expose credentials through .env files or unsecured memory spaces.

KeySentinel breaks this insecure paradigm:

• No unencrypted secrets on disk.
• No unguarded outputs without user consent.
• Ephemeral secrets that self-destroy after a timeout.
• Clear warnings to educate developers about security risks.

"If it’s not encrypted, it’s exposed. If it’s on disk, it’s compromised." — The Zen of Zero Trust

⚡ Quick Usage

Encrypt and store a token via Python

from keysentinel import upsert_encrypted_fields

upsert_encrypted_fields(
    fields={"github_token": "ghp_xxx123"},
    item_title="GitHub CLI Token",
)

Retrieve and decrypt a token via Python

from keysentinel import retrieve_and_decrypt_fields

fields = retrieve_and_decrypt_fields("GitHub CLI Token")
print(fields["github_token"])

Using the CLI (Recommended)

# Encrypt and store fields securely (values prompted securely)
keysentinel encrypt-token --title "AWS CLI Credentials" --fields aws_access_key_id --fields aws_secret_access_key

# Or use a predefined profile
keysentinel encrypt-token --title "GitHub Token" --profile github

# Retrieve and decrypt fields
keysentinel get-token --title "AWS CLI Credentials"

⚠️ Credentials will be cleared from your terminal and memory automatically after a short timeout.

🛡️ Security Model

📂 Token Profiles (Built-in)

KeySentinel supports predefined profiles to simplify common API credential handling:

and many others… (30+ profiles supported!)

You can list and use these profiles by passing --profile <profile_name>.

🛠️ Extend with Custom Profiles

You can extend KeySentinel by creating a file at:

~/.keysentinel_profiles.json

Example content:

{
  "huggingface": {
    "description": "Hugging Face API Token",
    "fields": ["hf_token"]
  },
  "figma": {
    "description": "Figma Personal Access Token",
    "fields": ["figma_token"]
  }
}

When running encrypt-token, your custom profiles will be automatically available!

❌ Why Export is Blocked

KeySentinel blocks plaintext exports (--export-env, --export-json) intentionally.

Attempting to use them shows this educational warning:

⚠️ Do NOT store or copy them into plaintext files or version control.

"If it's not encrypted, it's exposed. If it's on disk, it's compromised."

from "The Zen of Zero Trust"

For more info:

• run: import zero_trust
• read: Zero Trust Local Environment Manifesto

📜 Zero Trust Manifest

You can load the philosophy inside Python:

import zero_trust

Or read it online:

👉 Zero Trust Local Environment Manifesto

🔗 Related Reading

• Zero Trust Architecture (NIST)
• Zero Trust Local Environment Manifesto
• Two-Layer Security Architecture for Token Management

🛃️ Roadmap

• Secure CLI operations
• Custom and extensible token profiles
• Memory-timeout auto-clear after exposure
• Multi-vault support (future)
• Bitwarden CLI integration (future)

⚖️ License

MIT License

👨‍💼 Author

Built with ❤️ by Davi Luiz Guides

KeySentinel: Secure your tokens, secure your workflows. 🔐