Duscode
Download Sign in

Concepts

Secrets vault

Keep tokens, SSH keys and database URLs in Duscode's encrypted vault. Dus uses them by name and never sees the values; you manage them in Settings → Vault.

The vault holds the credentials your projects need: GitHub and registry tokens, hosting tokens, SSH keys for your servers, database URLs and payment keys. Dus uses each one by name and never sees its value. Values never reach your AI provider.

How Dus uses a secret

Dus refers to a secret by its name, such as DATABASE_URL. When a command needs it, Duscode puts the value into that one command's environment, and nowhere else. The approval card and the chat show only a placeholder with the secret's name, and say which variables come from the vault.

Every use is recorded in the vault's usage log: which secret, which session and when.

Redaction

Duscode masks every vault value as [secret:NAME] wherever it could appear: command output, Dus's replies, the chat history, the journal, memory, error messages, and what is sent to your provider. It also catches common encodings of a value (such as base64, URL encoding and hex) and each line of a multi-line value such as a private key.

Two things it can't catch: values shorter than 4 characters, and secrets shown in a screenshot, which is sent as a picture.

When a secret is missing

When a task needs something only you know, such as a server address or a token, Dus shows a Needs you form in the chat. A secret field shows a lock and the name it will be saved as. For a key file, click Choose file, or Paste it instead.

Click Save and continue. The value goes straight into the vault on this machine; Dus learns only that it was saved under its name, and carries on. Not now cancels the form.

You enter each secret once. The next task that needs it finds it in the vault.

The terminal app uses the vault for commands but can't show the form. Add missing secrets in Settings → Vault.

Global or project

Each secret is either:

  • This project: only this project can use it. This is the default.
  • All projects: every project can use it.

If a project has its own secret with the same name as a global one, the project's own wins.

Where it is stored

  • The vault lives in your Duscode home folder (~/.duscode/vault/), readable only by you. It is never in a project, never committed and never synced to Duscode Cloud.
  • Each value is encrypted with AES-256-GCM.
  • The encryption key is kept in your OS keychain when there is one: the macOS Keychain, the Secret Service (libsecret) on Linux, or Windows DPAPI for your user. Otherwise it is a key file only you can read, ~/.duscode/vault/vault.key. Settings → Vault says which.

If the key can't be read (for example the keychain is locked), Duscode says so instead of creating a new one. An entry that can't be decrypted shows as unreadable: delete it and add it again.

Settings → Vault

Click your profile at the bottom of the sidebar, choose Settings, then Vault. You see every secret by name, with its scope (This project or All projects), file for a key file, and when it was last used. Values stay hidden.

  • Reveal shows a value after you confirm. Revealing is recorded in the usage log.
  • Delete removes a secret after you confirm. Commands that use it stop working until it is added again.
  • Add secret adds one yourself. See Add a secret.
  • Usage log lists when each secret was saved, used, revealed or deleted, and by which session. It never shows values.

Add a secret

  1. Click your profile at the bottom of the sidebar.
  2. Choose Settings.
  3. Choose Vault.
  4. Click Add secret.
  5. Type the name in Name, such as DATABASE_URL.
  6. Paste the value in Value.
  7. Tick Use in all projects if every project should be able to use it.
  8. Click Save to vault.

Names use capital letters, digits and _, and start with a letter. A value that starts with -----BEGIN (a private key) is saved as a file. You don't have to add secrets in advance: Dus asks for one when a task needs it.

Something missing or wrong? Email support@duscode.com.