cubby

secrets · everywhere · once

One place for every secret. Override per environment.

AES-256-GCM in Postgres, served to External Secrets Operator over HTTP. Layered envs: staging inherits production, overrides only what differs.

sign inquick-share — no account

what's inside

Built for the dull parts of secret management.

productionstagingpreview

layered envs

Inheritance, no duplication.

Drop a key on production — staging and preview inherit it for free. Override only what differs; the diff page surfaces drift instantly.

cubby

eso native

Plugs into your cluster.

Per-cluster bearer tokens, last-used staleness tracking, OpenAPI on the bulk + per-key endpoints.

v1v2v3v4v5BACKEND_DB_URL

audit trail

Every change, forever.

AES-256-GCM in Postgres. Every upsert/delete writes a history row with who, when, and what kind.