What's new in Vaultez

New

• Share a copy of a secret with people outside Vaultez (Pro). Vaultez emails a one-time link that expires after 1 hour, 1 day or 7 days. The recipient also needs a passphrase that Vaultez generates and shows only to you, so you can pass it on another way. The copy is decrypted in the recipient's browser with a key we don't keep. If the value changes before the link is opened, the link is cancelled and you're emailed to share again.

• Every access to a value is logged. Secret values are no longer part of the page: they stay hidden until you reveal or copy them, and each reveal, copy, CLI fetch and project-token fetch appears in the secret's activity history, each with its own icon.

• Choose a company after login. If you belong to several companies, you pick which one to open.

• Warnings before a downgrade. Owners are emailed 7 days and 1 day before a trial ends or a cancelled plan expires, and right away when a payment fails, with a list of what will stop working.

• A public security page describing where data is stored, how it's encrypted and who can access it.

Security

We ran a series of internal security reviews and fixed everything they found. No customer data was exposed. The main improvements:

• Removing someone fully removes their access. Removing a member from a company or project now also ends their CLI access and revokes the project tokens they created.

• Invitations must be accepted. Existing Vaultez users are only added to a company after they accept the invitation while logged in.

• Stronger sign-in. Logging out ends the session everywhere; sessions expire after 12 hours of inactivity; changing your password or email signs you out on all devices, and a password change also revokes CLI tokens; password reset links work once; login and 2FA attempts are rate limited.

• More data encrypted. Secret notes, the details in the activity history and 2FA secrets are now encrypted, like secret values already were.

• Tighter permissions. Only people who manage a secret's access can change who sees it, only project owners can delete a project, and billing is limited to company owners.

• Browser protections. A strict Content Security Policy, integrity-checked third-party files, and pages showing secret values are never cached.

• Up-to-date dependencies, including Rails 8.1.4, with no known vulnerabilities.

Plan changes

• Free now includes unlimited secrets, in 1 project for 1 user.

• The CLI, project tokens and the activity history are part of Pro. On Free, activity is still recorded, so the full history is there as soon as you upgrade.

• Going over the Free plan's limits (for example after a trial ends): the company's first project stays fully usable for the owner who created the company. Other projects are shown as locked and become read-only: their secrets can still be viewed, copied and deleted, but not changed. Nothing is deleted, and upgrading restores everything.

Good to know

• You'll be signed out once after this update.

• The edit page no longer shows the current value. Leave the value empty to keep it; to see it, reveal it on the secret page.

• Notes are text only; file attachments are no longer supported.

• Email addresses are case-insensitive, so you can sign in however you type yours.