// the find
keyshade-xyz/keyshade
Realtime secret and configuration management tool
Keyshade is a secret and configuration management platform that pushes live updates to running applications via WebSockets, so you don't need to restart services when a secret changes. It uses ECC public-key encryption so the server never holds plaintext secrets — only the client with the private key can decrypt. It's aimed at teams who want Doppler-style workflows but self-hosted or under their own control.
The live-update model is the genuinely interesting part: secrets propagate to running processes in real time via a reconciler, which is useful for feature flags and rotating credentials without downtime. The ECC encryption scheme is well-thought-out — encrypting at rest means a compromised database dump doesn't expose secrets. The migration history is dense and active (50+ migrations, last schema change this week), which means the project is moving fast and not vaporware. The Turborepo monorepo structure with separate CI jobs per app (validate-api, validate-cli, validate-web) keeps the test surface honest.
The SDK story is thin — the CLI exists, but if your runtime isn't TypeScript/Node you're essentially polling a REST API yourself; there's no official SDK for Python, Go, or Java. The 'AI anomaly detection' claim in the README is marketing fluff with no visible implementation in the codebase. Self-hosting is PostgreSQL plus a NestJS API plus a Next.js frontend with WebSocket infrastructure — that's a meaningful ops burden for a team that wanted to simplify secret management. The project is still pre-1.0 in behavior despite the feature list, and the custom-roles and approval-workflow features add enough surface area that a security audit of the authorization layer would be non-trivial.