Limited value
Can reduce accidental exposure
- Encrypts secret values at rest in a vault.
- Keeps plaintext out of ordinary project files and command arguments.
- Locked mode adds a boundary when the vault file alone leaks to a different host.
Archived experimental project · No longer maintained
Amulet is now a historical project record
Amulet may reduce accidental exposure of secret values encrypted at rest, but it does not solve secret zero or protect secrets after host, CI job, or unlock-credential compromise. It is not recommended as the sole secret-management mechanism for production systems or for new production use.
What the archive records — and what it never guaranteed
Not protected
Does not establish a trusted runtime
- Does not solve secret zero for unattended systems.
- Does not protect against same-host, same-user, root, Docker-socket, or unlock-credential access.
- Does not protect against an AI agent with unlock access or a compromised CI job receiving the passphrase or identity key.
Mode boundaries
Machine ID is not a secret. Locked mode mainly addresses a vault copied by itself to a different host. In Portable mode, the passphrase is the primary cryptographic boundary. Neither mode protects plaintext after unseal.
Read the existing-deployment reference →