I built a self-hosted one-time secrets service in Node — here's the threat model

<p>Hey everyone! 👋</p> <p>Like many developers and sysadmins, I constantly find myself needing to share temporary credentials, API keys, or sensitive text with clients and

<p>I had a screenshot to send. Nothing secret — a stack trace from a side project — but it had an internal hostname, a file path with my username, and a chunk of a config file in

<p>I've been building <a href="https://flowvault.flowdesk.tech" rel="noopener noreferrer">Flowvault</a>, an encrypted browser notepad. "Encrypted notes in the browser" isn't new —

<h1> Most developers have done this at least once: </h1> <ul> <li>Sent a password over Slack</li> <li>Shared credentials in email</li> <li>Copied secrets into a notes app and

<p>got annoyed that pastebin and similar sites log everything and keep your text forever, so i built one where the server literally cant read what you paste. heres how the

<h2> The Problem </h2> <p>You know what's funny about "free" AI coding tools?</p> <p><strong>They're not free.</strong></p> <p>Codex CLI says it uses your OpenAI credits — and

<h2> The 11pm key rotation </h2> <p>Two things have burned me more than once, and I suspect they've burned you too.</p> <p><strong>Incident one:</strong> a deploy that went green