Automic Vault

Automic Vault 4.8.2 · macOS

Railway hardener

The changes, security properties, caveats, and verification path for the railway hardener.

Railway hardener

Run av harden railway to apply this hardener and av doctor railway to verify it.

av harden railway installs the signed Railway Isotope and migrates legacy or OAuth credentials from the production, staging, and development config files into environment-and-host-bound Automic Vault Secrets. The files retain user and project metadata plus reserved non-secret @av markers.

The patched Target routes session reads, login and refresh stores, and logout or invalid-grant deletes through fixed Railway-only XPC operations. Each operation binds the live Target, complete arguments, Railway environment, host, and derived Secret Name.

Unsupported user fields, mixed legacy/OAuth credentials, partial markers, and incomplete sessions fail without changing any config file. The authorized Target receives reusable session material in memory; the Hardener cannot protect it after Secret Application.