Automic Vault Download

From the Creator of Homebrew

Secure the tools you brew install

Download for macOS

Before Automic Vault

“Helpful” agents take dangerous shortcuts.

  1. Claude

    Hmm… the remote server doesn’t have AWS access.

  2. Claude

    No problem — I’ll upload the keys from here.

  3. Tool call
    Read(~/.aws/credentials)
  4. Tool result 
    [default]
aws_access_key_id = AKIA••••••••••••
aws_secret_access_key = ••••••••••••••••••••••••••••••••
SECRET EXFILTRATED A reusable cloud credential just crossed the trust boundary.

After Automic Vault

Plaintext secrets: detected, encrypted and gated.

  1. Claude

    Hmm… the remote server doesn’t have AWS access.

  2. Claude

    No problem — I’ll upload the keys from here.

  3. Tool call
    Read(~/.aws/credentials)
  4. Tool result
    No such file
  5. Claude

    I’ll run the export command instead.

  6. Tool call
    aws config export-credentials
  7. Automic Vault
    Human Approval required

Encrypting secrets is not enough

Human Approval Required

Encrypting secrets is only half of it when those secrets can be used for sensitive actions.

Automic Vault doesn’t just protect your secrets; it gates use of those secrets.

Automic Vault approval gate showing ChatGPT requesting a GitHub token, with Deny and Approve Once controls
Command, working directory, and requested key—visible before anything runs.
Automic Vault Hardened Tools screen for gh with Allow Read-Only gh Requests enabled
Opt-in read-only approval on a per secret handling tool basis.
Automic Vault Secret Gate for gh allowing direct GitHub token access only when Terminal.app is the calling app
Full access—but only to Terminal.app.

Adjust access granularly. One rule for you and one rule for agents.

Every secret use is restricted by default. Relax the gate only for the code-signed executable you name.

Read only
Auto-approve safe queries without granting write access.
Full access
Always approve direct gh access only for a named calling app, such as Terminal.app.

Every secret use is logged.

Approved or denied, automatic or manual: every request leaves a local record with the launcher, key, command, working directory, and decision.

  • Decision
  • Launcher
  • Requested key
  • Working directory
Automic Vault secret request history showing denied manual and approved automatic gh requests with launcher, key, and working directory details
Denied and approved requests share the same audit trail.
Automic Vault Detectors screen showing Homebrew flagged as mutable with trigger conditions, rationale, and a hardening command
Each flag includes its trigger, rationale, and mitigation steps.

Continuous monitoring of threats to your developer environments

Automic Vault monitors developer tools across all ecosystems. New threats are flagged instantly, with clear steps to mitigate each finding.

Free and open source.

Automic Vault costs nothing, but if you want additional security, the optional iPhone app is a paid subscription that moves approval gates off the computer running the commands and onto your phone, where no agents or malware can intercept them.