Cloud Platform / Product 03

Cyberia SecretOps

One source of truth for every secret you deploy. A secrets control plane: multi-tenant organizations, projects and apps with editable environments, app-to-app token sharing with no human reveal, infrastructure assets, an organization vault, policies, scheduled rotations and built-in generation tools.

Request a demo @cyberiasoftware/cybsecrets
Release
Zero
Human Reveals
Per-App
Environments
Scheduled
Rotations
Full
Audit Trail

Generally Available · v1.3.0

// Overview

Secrets stored once. Deployed everywhere.

Cyberia SecretOps is the third product on the CYBERIA Cloud Platform. It stores and deploys secrets across your applications from a single source of truth — third-party API tokens and your own alike. Organizations isolate tenants, projects group the apps that ship together, and every app declares its own environments so a value exists once per stage rather than once per developer machine. Tokens issued for your services can be shared with other apps and resolved at runtime without a human ever revealing them, infrastructure assets hold platform-level credentials that apps import, and policies plus scheduled rotations make sure nothing ever breaks on an expired token. Reveal history, audit events and browser-side generation tools complete the loop.

  • Single source of truth for third-party and first-party secrets
  • Multi-tenant organizations with isolated projects and apps
  • Fully editable environments per app — dev, staging, production and beyond
  • App-to-app token sharing with zero human reveal
  • Infrastructure assets with feature-grouped platform credentials
  • Organization vault for recovery codes and vendor logins
  • Policies and scheduled rotations with overlap windows
  • Full audit trail with per-reveal host, environment and reason
  • Built-in token, hash, bcrypt and UUID generators
  • cybsecrets CLI on npm — browser or token login, then secret injection at build and runtime
SecretOps dashboard
SecretOps dashboard
The control center — secrets, projects, rotations, policies, audit events and expiring credentials in one view.
// The hierarchy
Organizations
Projects
Apps
Environments
Assets
Vault
Policies
Rotations
Capabilities

Ten surfaces.
One secret estate.

Each capability has its own page with the console screenshots, the operational model and the reasoning behind it.

01 / Console

Control Center

The SecretOps dashboard aggregates total secrets, projects, active rotations, policies, audit events and credentials expiring soon, with a live recent-activity feed of reveals, creates and rotations.

View feature
02 / Tenancy

Organizations

Create and manage organizations as isolated tenants, each with its own logo, brand colours, slug, website and contact address, plus organization-scoped projects, apps, keys and assets.

View feature
03 / Structure

Projects, Apps & Environments

Each organization holds projects, and each project holds apps. Every app declares its own environments — development, staging, production or anything you define — so secret values are stored per environment instead of per file.

View feature
04 / Core

Secrets & Environments

The secrets browser shows every secret for the selected app with its type, origin, reveal count, expiry and a masked value column for each environment — dev, staging and production side by side.

View feature
05 / Zero-reveal

Token Sharing

Generate a token for your own app and grant it to another app inside the organization. The consuming app resolves the value at runtime through the SDK; nobody has to read, copy or paste the secret to make the integration work.

View feature
06 / Platform credentials

Infrastructure Assets

Assets model the platforms you run on — Azure, AWS, Google Cloud, GitHub, Netlify, Oracle, on-prem servers — and hold their credentials in feature groups such as OAuth SSO, BigQuery, Maps API or Cloud Storage, ready to import into any app.

View feature
07 / Custody

Organization Vault

The vault holds organization-level secrets that are not application configuration: recovery codes, passwords, API keys and third-party platform credentials, searchable by name, platform or username and typed for clarity.

View feature
08 / Access

API Keys & Roles

Issue API keys at organization, project or app level, assign a role such as operator or viewer, set an expiry and track status by prefix — so a CLI, a CI pipeline and a server agent each authenticate as themselves.

View feature
09 / Governance

Policies & Rotations

Policies define how long a credential may live, who may reveal it and where. Rotations execute the renewal on schedule, push the new value to every environment that consumes it, and keep the previous value valid through the overlap window.

View feature
10 / Utilities

Secret Tools

A built-in toolbox for the everyday cryptographic chores: generate random tokens with the exact character classes and length you want, hash text, compute bcrypt digests and mint UUIDs, without leaving the console or pasting values into a random website.

View feature
11 / SDK

cybsecrets CLI

@cyberiasoftware/cybsecrets is the public SecretOps CLI. Install it globally or run it with npx, and it resolves secrets through the same hierarchy the console uses — Organization → Project (group) → App → Environment.

View feature
12 / Authentication

Console & Browser Login

cybsecrets login offers two paths: an interactive device flow that opens the browser with a short-lived pairing code, or a direct scoped API token for CI and headless machines. Either way the CLI only ever sees what the credential is allowed to see.

View feature
13 / Configuration

Guided Init & Scope

cybsecrets init walks the hierarchy interactively and only asks for the levels your token can still resolve. If the credential grants a single organization, project or app, that level is selected automatically and skipped.

View feature
14 / Deployment

Runtime Injection

cybsecrets run -- <command> resolves the configured scope, injects the environment's secrets into the host environment for that process only, and executes your build or server. Production values never touch the repository, the image or a CI settings screen.

View feature
// Inside the console

A guided tour

Organizations
Organizations
Organizations as isolated tenants, each with logo, slug and brand colours.
Projects and apps
Projects and apps
Projects grouping apps, each app carrying its own editable environments.
Secrets
Secrets
Secrets per app with a masked value column for every environment.
Infrastructure assets
Infrastructure assets
Platform credentials grouped by feature and imported into the apps that need them.
// Zero human reveal

Machines exchange secrets. People approve them.

Issue a token for your own service and grant it to another app in the organization. The consumer resolves the value at deploy time through the SDK and CLI — no copy, no paste, no plaintext in a chat thread. Policies and scheduled rotations keep those values fresh so nothing ever breaks on an expired token.

Node / TypeScriptPythonGoDockerKubernetesGitHub ActionsGitLab CIServer agents
Reveal history
Reveal history
Every reveal recorded with environment, host, runtime and reason.
// Case studies

Where teams put it to work.

Case 01 / Payments platform

Policy-driven rotation with zero broken deployments

Cloud PlatformFintechSaaS
Challenge
Provider tokens expired without warning and took services down. Secrets lived in CI variables that half a dozen people could read.
Approach
Secrets moved into SecretOps with per-app environments, machine-to-machine sharing with no human reveal, rotation policies ahead of expiry, and a full reveal history per key.
0
expiry-driven outages
100%
accesses audited
-70%
onboarding time per service
Environment-scoped secrets browsed per app.
Environment-scoped secrets browsed per app.
Environment-scoped secrets browsed per app.
Reveal history makes every access to a key auditable.
Reveal history makes every access to a key auditable.
Reveal history makes every access to a key auditable.
Case 02 / Product engineering org

CLI-injected secrets in every CI/CD pipeline

Cloud PlatformSaaSDefense
Challenge
Each pipeline had its own copy of production credentials pasted into the CI provider's UI, and nobody could migrate providers without re-entering everything.
Approach
Teams install the npm CLI, log in from the terminal or the browser device flow, bind the repository to an organization, project, app and environment, and let the build inject secrets into the runtime.
0
secrets stored in CI settings
1 command
to bind a new repository
Portable
across CI providers
CLI init binds the repo to org, project, app and environment.
CLI init binds the repo to org, project, app and environment.
CLI init binds the repo to org, project, app and environment.
Build logs show secrets injected into the production runtime.
Build logs show secrets injected into the production runtime.
Build logs show secrets injected into the production runtime.

Ready to deploy Cyberia SecretOps?

Initialize Engagement