# Automic Vault

> Automic Vault removes plaintext credentials from developer Tools and controls their application through each Verified Launcher and Target at the Local Execution Boundary.

## Product

- [Homepage](https://www.automicvault.com/): Explains the Local Execution Boundary, Verified Launchers, Authorization Policy, and Authorization History on macOS.
- [Download](https://www.automicvault.com/download/): Provides the signed macOS disk image, installation details, included components, and first steps after setup.
- [Documentation](https://www.automicvault.com/docs/): Source-checked Automic Vault 2.9.0 CLI manual covering scan, doctor, save, inject, bless, harden, catalogs, and app links.
- [Package catalog](https://pkg.so/): Searchable catalog of developer packages, dependencies, install commands, risk information, and Automic Vault hardening coverage.
- [Source and releases](https://github.com/automic-vault/automic-vault): Apache-2.0 source code, tagged releases, implementation history, and public issue tracking.

## Security and Architecture

- [About](https://www.automicvault.com/about/): Describes the project, founder Max Howell, macOS focus, local execution model, and relationship to Homebrew.
- [The best AWS credential manager](https://www.automicvault.com/blog/best-aws-credential-manager/): Explains process-bound AWS credential delivery, temporary STS sessions, signed-launcher policy, MFA and role support, and the fail-closed profile model.
- [macOS security for the terminal](https://www.automicvault.com/blog/bringing-macos-security-to-the-terminal/): Explains inherited CLI authority and the identity, Approval, and Authorization History boundary beneath shells and agent harnesses.
- [Mac security best practices for agents](https://www.automicvault.com/blog/mac-security-best-practices-for-agents/): Gives a least-authority macOS baseline covering Gatekeeper, SIP, local builds, Downloads, privacy grants, and command-line protection.
- [Security reporting](https://www.automicvault.com/.well-known/security.txt): Publishes the current security contact, preferred language, canonical location, and expiration date.

## Incident Analysis

- [Blog](https://www.automicvault.com/blog/): Index of developer security guidance and analyses of package, extension, credential, and local execution incidents.
- [Keyv npm supply-chain worm](https://www.automicvault.com/blog/prevent-keyv-npm-worm/): Explains how protected local credentials and a low-privilege install terminal would have broken the worm's credential theft and stolen-token propagation path.
- [Nx Console extension compromise](https://www.automicvault.com/blog/prevent-nx-console-vscode-compromise/): Analyzes local credential theft by a compromised VS Code extension and the relevant endpoint controls.
- [GitHub employee device breach](https://www.automicvault.com/blog/prevent-github-vscode-extension-breach/): Examines a poisoned editor extension, repository access, and controls at the developer workstation boundary.
- [LiteLLM PyPI compromise](https://www.automicvault.com/blog/prevent-litellm-pypi-compromise/): Maps malicious Python releases and credential theft to local secret storage and executable approval controls.

## Website Policies

- [Privacy](https://www.automicvault.com/privacy/): Explains website analytics, local product data boundaries, Keychain storage, logs, diagnostics, updates, and public reporting guidance.
- [Terms](https://www.automicvault.com/terms/): Summarizes website use, Apache-2.0 licensing, release artifacts, package metadata, third-party services, and warranty boundaries.

## Key Facts

- Category: local execution security and secrets management
- Platform: macOS
- Current documented release: 2.9.0
- License: Apache License 2.0
- Pricing: free open-source software
- Founder: Max Howell, creator of Homebrew
- Secrets remain in Keychain until an authorized Target receives them for one run.
- Authorization Policy considers the Target, Verified Launcher, command, working directory, and Secret Names.
- Root compromise and a malicious authorized Target remain outside the product security boundary.

## Command Surface

- `av scan --show-all` audits credential exposure and unsafe tool configuration.
- `av doctor --json` checks launchers, dependencies, ownership, permissions, content, and path precedence.
- `av save GH_TOKEN` prompts through `/dev/tty` and stores a named value in Keychain.
- `av inject +GH_TOKEN gh auth status` releases a named value to one approved command.
- `av detectors --json` and `av hardeners --json` publish the installed security catalogs.

## Contact

- Website: https://www.automicvault.com/
- Source: https://github.com/automic-vault/automic-vault
- Security reports: https://github.com/automic-vault/automic-vault/issues