// HACKER NEWS — CYBERSECURITY
Show HN: Laptop is the last place your secrets are still in plaintext
Documentation ·
Quickstart ·
Supported tools ·
Command reference ·
Security
Status: macOS-only (Apple Silicon), and still in development.
Your secrets live in plaintext all over your machine: .env files,
~/.aws/credentials, ~/.zshrc exports, .npmrc tokens, MCP configs. Anything
running as you can read them. A bad curl | sh, a sketchy npm install, or one
of the AI agents now running in your editor with your full permissions.
jit moves each secret into a local encrypted vault gated by Touch ID, and
rewrites the files so your tools keep working. On disk there's now a decoy. The
real value only appears, in memory, for the specific process that asked for it,
after a biometric prompt. The result: you unlock once, jit asks before handing
a credential to a tool (or an agent), and there's a decoy on disk the rest of
the time.
Apple Silicon only — on an Intel Mac, build from source with
go install github.com/jitpass/jit/cmd/jit@latest.
Pick one route. If you installed from the tarball before and are switching to
Homebrew, remove the old copy after the brew install (sudo rm /usr/local/bin/jit); otherwise two jits sit on PATH upgrading separately, and
jit doctor will flag it.
Releases are signed with a Developer ID and notarized by Apple, so both paths
run without a Gatekeeper prompt: Homebrew quarantines its downloads and
Gatekeeper clears them against the notarization ticket, while curl (and go install) set no quarantine flag at all. To check what you got rather than
take our word for it, run jit doctor — its jit line reports
signed CZC6BH93GJ, using the same check jit upgrade runs before it will
install anything.
Upgrading: brew upgrade jitpass, or jit upgrade — a verified
self-update (Developer-ID signature and checksum both checked before the
swap, restarts the service). Either way your vault is untouched.
Homebrew installs shell completion with the binary, so jit completes
subcommands, flags, vault paths, and wrappable tool names out of the box.
Installed from the tarball or from source, add it yourself:
Either way, jit doctor tells you if completion isn't reaching your shell.