Bun Secrets Vault
A config loader that keeps secrets out of git by storing them in the OS credential store through Bun.secrets: macOS Keychain, Linux libsecret, or Windows Credential Manager, encrypted at rest and scoped to the logged-in user. Because Bun.secrets has no native list, the vault maintains its own key index as one extra secret so set, get, list, and rm behave the way a CLI user expects, with a process.env fallback for CI. Ships a small CLI plus a run subcommand that injects every stored secret into a spawned child process env through Bun.spawn, and a loadConfig(keys) library export for application code. Zero npm dependencies: Bun.secrets, Bun.spawn, and process.env cover the whole surface.
npx shadcn@latest add https://ui.aryank.space/r/bun-secrets-vault.jsonInstalls from ui.aryank.space. To add it by hand, copy the files in Files below, or register the @compronents namespace via the docs.
The API key sits in a plaintext .env, one careless git add away from history. Once it lands in a commit, rotating the key is the only fix; deleting the file changes nothing, because git remembers. Every clone, fork, and CI cache now holds the secret forever.