Unified matrix
Every app's environments and keys in one grid — compare and edit across environments side by side, instead of one environment at a time.
Internal config & secrets manager
There is no secret. Only keys.
Keymaster is Soundstripe's cross-application manager for configuration and secrets —
one matrix of apps × environments × keys, backed by encrypted storage,
governed by GitHub access, and delivered to every app by the keymaster CLI.
Config and secrets are managed identically — sensitivity is a per-key attribute, not a separate system. Values are versioned and encrypted at rest, inheritance is resolved at read time, every change is attributable, and the few places a value is ever shown are gated by role and audited.
Inheritance & overrides
Environments inherit from one another with overrides winning, resolved at read time — and production never resolves a non-production value.
Per-key sensitivity
One store, one model. A per-key sensitivity flag drives masking, log/error scrubbing, RBAC, and reference-first reads — “there is no secret, only keys.”
Per-user audit
Every read, write, reveal, and export is attributable to a GitHub identity, recorded before the change lands, and reversible.
GitHub access & RBAC
Sign in with GitHub, gated on org and team membership, with per-app and per-environment roles and step-up re-auth for production writes.
CLI & encrypted delivery
The keymaster CLI fetches values under policy and serves them to apps from an encrypted, memory-resident local daemon.