cubby
Share a secretPricingGitHubSign inStart free

Set a secret once. Every environment inherits it.

Production is the base. Staging and preview inherit from it and override only what differs. Serve the result to Kubernetes, pull it into your shell, or push it to Unkey. Self-hosted, encrypted with AES-256-GCM.

Start free
acme / api-gateway

Switch environments, reveal a value, or click a key.

STRIPE2

  • STRIPE_SECRET_KEY
    Overrides production·v3·flo, 4 wk. ago
  • STRIPE_WEBHOOK_SECRET
    Overrides production·v1·flo, 4 wk. ago

OTHER5

  • DATABASE_URL
    Overrides production·v2·ana, 4 wk. ago
  • FEATURE_NEW_CHECKOUT
    v1·mika, 3 wk. ago
  • LOG_LEVEL
    Overrides production·v1·flo, 2 mo. ago
  • REDIS_URL
    Inherited from production
    production
  • SENTRY_DSN
    Inherited from production
    production
The real interface, running on example data in your browser.

How layering works

One value, set once, read everywhere it applies.

  1. 1

    Set it in the base

    Put a key in production. Every environment that inherits from production can read it straight away.

    production DATABASE_URL = postgres://prod
  2. 2

    Override where it differs

    Give staging its own database URL. Only staging changes, and production keeps its value.

    staging DATABASE_URL = postgres://stg
  3. 3

    Everything else falls through

    Preview sets nothing, so it reads staging's value, and production's where staging has none. Change the base once and it lands everywhere.

    preview DATABASE_URL ← staging

Getting it into your app

Read it from the cluster, pull it on your laptop, or push it upstream.

Kubernetes

pod/api-7f9c·SecretSynced
DATABASE_URL
STRIPE_SECRET_KEY
REDIS_URL

Inheritance and references resolve server-side, so the pod only ever sees flat values.

CLI, local and CI

$cubby run -- pnpm dev
✓Resolved 7 secrets from production
ready on http://localhost:3000

Values never touch disk with cubby run — they go straight into the child process environment.

Sync upstream

backend / productionSTRIPE_SECRET_KEY v7
unkey · api / prodSynced

Every write re-pushes the whole resolved set, so the destination can't drift out of sync.

Security

What keeps your values safe.

Envelope encryption
Every secret has its own data key, wrapped by a master key. Rotating the master key re-wraps the data keys without re-encrypting any values.
Every reveal is on the record
Showing or copying a value writes an audit entry with who and when. The dashboard doesn't fetch a value until you ask for it.
End-to-end encrypted shares
The decryption key lives in the link's fragment, so it never reaches the server or its logs. Links can expire, burn after a set number of views, or need a password.
Scoped machine tokens
Each cluster or CI job gets its own token, limited to what it needs, with last-used tracking so stale tokens are easy to spot.

Stop grepping four .env files.

Self-host it in a few minutes, or share a single secret right now without making an account.

Start freeShare a secret, no account