Security

We can't read your secrets. Here's how.

StackHangar is a zero-knowledge secrets manager for the keys behind your products, so it's built on one rule: secrets are encrypted and decrypted only on your device. Our servers store ciphertext and the few dates alerts need, nothing else.

Encrypted on your device

• A random vault key, made in your browser, encrypts every item: values, item names, notes and even project names. It never leaves your device unwrapped.
• Items are encrypted with AES-256 before they're stored. The server can't tell a Stripe key from a domain renewal.
• You can rotate the vault key at any time. Your browser re-encrypts every record with a new key and swaps them in one step. If anything doesn't match, nothing changes.

Unlocked with passkeys, not a master password

• Your passkeys (Face ID, Touch ID, Windows Hello or a security key) unlock the vault using the WebAuthn PRF extension. Each passkey unlocks its own wrapped copy of the vault key.
• You set up at least two passkeys and a printable recovery key at signup. Any one of them opens the vault.
• Passkeys are tied to app.stackhangar.com only, so no other page, even on our own domain, can ask for them.
• Signing in with an email code or GitHub gives you a signed-in but locked session. Only a passkey opens the vault.
• Changes to security settings, such as adding a passkey or connecting an agent, need a fresh passkey prompt. Being signed in isn't enough.

Staying unlocked across reloads

So you don't have to touch your passkey on every page load, your browser keeps the vault key wrapped under a random device key, and our server holds only that device key. Neither half opens the vault on its own. The server releases the device key only to the same signed-in session, only until you've been idle too long (15 minutes by default), and never after 12 hours.

Alerts without plaintext

To remind you, the server needs to know when, not what. Each alert is an opaque ID and a date. The email says how many items need attention and when, and nothing else: no project, provider or key name. You unlock to see which one.

AI agents get references, never values

• Claude Code, Cursor and other agents connect through our MCP server, each with its own identity you can see and revoke.
• An agent can ask you to paste a new key, request access to one, or propose a playbook. It receives reference IDs and your approve or deny answer, never a credential value.
• Approvals happen on app.stackhangar.com with your passkey, never inside the agent's chat.

Playbooks that push from your browser

When a playbook pushes a new key to Vercel, GitHub or Netlify, your unlocked browser calls the provider directly with a token decrypted on your device. The value goes from your browser to the provider and never passes through our servers.

Rules decide, AI only explains

Fixed, tested rules decide what's urgent, what's overdue and which steps a playbook has. AI can explain a finding or a step in plain English, but it never changes what you see. When you ask for an explanation, only fixed-list fields leave your device, like the finding type, the provider and roughly how soon it's due. Never names, values, notes, URLs or dates.

No lock-in

If your plan lapses, your vault turns read-only. You can always unlock it, view everything and export it. The export is decrypted on your device, after a passkey check, and nothing decrypted is sent to us.

Known limits

No browser-based vault can promise more than the code it runs, so here's what this design doesn't protect against:

• Malicious code served from our app. If an attacker took over our servers and shipped altered JavaScript, it could read the vault key the next time you unlock. We reduce this with a strict content security policy, no third-party scripts, and an app origin separate from this site.
• A copied browser profile. Someone who copies your browser profile while you're unlocked could open the vault from it. If a device is lost or stolen, remove its passkey, rotate your vault key (which also signs out other sessions) and rotate the credentials stored in it.
• A compromised device. Malware on the computer you unlock from can see what you see.

Report a problem

If you find a security issue, email hello@stackhangar.com with "Security report" in the subject.