Ranbval Secret Manager — Secrets That Refuse to Be Stolen
Every other secret manager keeps your API keys safe. Ranbval Secret Manager assumes yours will be stolen anyway. Store OpenAI, Stripe, AWS or any credential sealed with AES-256-GCM, and a leaked key still gets you nothing: it does not decrypt outside the repos you allowed, it raises a security error if anything tries to print, iterate or read it, and every access attempt alerts the owner.
Key features
- AES-256-GCM at rest; a stolen config decrypts nowhere else
- Raise-on-extraction — print, str(), iteration, encode() and buffer reads all fail loudly
- Every access attempt detected, with canary keys for zero-false-positive theft signals
- Secure proxy execution — the real key never enters your process at all
- Environments (development / staging / production) with per-stage keys
- Git-origin and workflow allowlists you control; revoke anyone in one click
- Live audit telemetry, leak alerts by email, mandatory 2FA
- Python SDK on PyPI; Node.js SDK in active development
Frequently asked questions
- What is Ranbval?
Ranbval Secret Manager is a secret manager for API keys that makes a stolen key useless. Secrets are sealed with AES-256-GCM, decrypt only on the repos you allowed, raise a security error if anything tries to read them, and every access attempt alerts you. You can also route calls through a secure proxy so the real key never enters your process.
- How is Ranbval different from a .env file?
A .env file leaks the moment it is committed, screenshared, or copied to a teammate. Ranbval stores secrets encrypted with your project secret, binds usage to allowlisted Git remotes, and emits a live audit trail of every decrypt or proxy call.
- Which languages does the Ranbval SDK support?
Ranbval ships official SDKs for Python (pip install ranbval-sdk) and Node.js (npm install ranbval-sdk). Both speak the same wire format, so a token issued for one decrypts identically in the other.
- Does Ranbval ever see the plaintext of my API keys?
Only the secure proxy path needs server-side decryption, and even then the plaintext stays inside the proxy process — it is never returned to your machine and never logged. Local decryption via the SDK happens entirely on your client.
- Is Ranbval free to use?
Yes. Sign up, create a project, and use the vault and SDKs without entering a payment method.
Home
·
Pricing
·
Terms
·
Privacy
·
Refund
