End-to-end encrypted secret sync for developer teams. Stop Slacking your .env.
Warning
Sotto is pre-1.0 and has not had a third-party cryptographic audit. See SECURITY.md.
flowchart LR
subgraph devices["Devices - plaintext and keys stay here"]
direction TB
cli["sotto CLI - init, set, run, share"]
web["Browser vault - the same core via WASM"]
core["sotto-core - KDF, XChaCha20-Poly1305 envelopes, X25519 sealed-box grants, rotation"]
cli --> core
web --> core
end
subgraph server["Server and network - ciphertext it cannot read"]
direction TB
api["Sync API - versioned writes, per-member grants, rotation log"]
db[("Postgres - envelopes and grants")]
api <--> db
end
core -- "encrypted envelopes" --> api
core -- "sealed grants" --> api
core -- "one-time shares" --> api
style server stroke-dasharray: 5 5
Everything left of the dashed boundary holds keys and plaintext. Everything right of it only ever sees ciphertext - including the database if stolen.
| I want to… | Start here |
|---|---|
| Use Sotto | curl -fsSL https://raw.githubusercontent.com/getsotto/sotto/main/install.sh | sh, then the quick start |
| Contribute | CONTRIBUTING.md, then a good first issue |
| Self-host | One-command deploy in deploy/README.md |
| Repo | What it is |
|---|---|
| sotto | CLI, sync server, web client, and the shared crypto core |
| sotto-action | Install the CLI in GitHub Actions |
Security model in 30 seconds
- Zero knowledge sync: the server sees ciphertext plus minimal metadata, never plaintext or usable keys.
- Teams: organisations with roles, per-member environment grants, key rotation on member removal, machine tokens for CI, lost key recovery.
- Honest limits: metadata exposure, pre transparency key directory, and the weaker assurance of the served browser client are all documented in THREAT-MODEL.md.
- Report vulnerabilities privately per SECURITY.md, never as a public issue.
First contribution in 5 minutes
- Fork and clone sotto.
- Pick a good first issue - docs and CLI help-text issues need no cryptography knowledge.
- Sign off every commit with
git commit -s(Developer Certificate of Origin). - Questions that are not bugs belong in Discussions.