Security

Encryption at rest

Secret values are encrypted with AES-256-GCM. The key is ELSAI_VAULT_ENCRYPTION_KEY, falling back to NEXTAUTH_SECRET. Keep the key stable; changing it after secrets exist prevents decrypt.

Who can see a secret

• Vault page: only the creator can view, edit, or delete the secret.
• API key (elsai_arms.get_secrets / POST /api/vault/get-secrets): any valid key for the instance can retrieve by Key or Tag.

CORS

For browser JavaScript on another origin, list that origin in ELSAI_ALLOWED_CORS_ORIGINS (or ELSAI_ALLOWED_ORIGINS). Disallowed origins receive 403. Same-origin and server-to-server calls do not need the allow-list.