What problem does it solve? Credentials scattered across multiple encryption mechanisms can leak into logs, API responses, or cross-tenant rows. This Skill enforces one vault mechanism where every secret is cryptographically bound to its owning organization or member, so copied ciphertexts fail to unwrap. ## Core Features & Use Cases - Envelope encryption with owner binding: Each secret is sealed with its own data key, which is sealed by a key derived from the master key and the owner's scope, making tenant isolation cryptographic rather than a WHERE clause. - Typed secret kinds: Supports api_key, azure_openai, aws_credentials, gcp_service_account, and none, with validation on input so malformed credentials fail at save time instead of hours later. - Leak prevention invariants: No API response, log line, audit entry, or exported spec ever carries a plaintext secret; tests/api/test_no_secret_escapes.py pins these guarantees. - Use Case: When adding a new provider credential type, follow the Skill to add a model in secret_kinds.py, a branch in model_resolver._build_provider, a Builder form field, and a migration only if the stored shape changes. ## Quick Start Use the vault-secrets skill to add a new secret kind for a third-party service key and wire it through the provider resolver.
