The problem
When you use Git or the AWS CLI, your tokens and keys often sit in plain files, or in places any program running as you can read. You would never know if one did.
What I built
Wardkey is a small, experimental tool for Windows. It keeps your Git and AWS credentials in an encrypted vault. When Git or AWS asks for a key, Wardkey checks which program is asking and applies your rules before giving anything out.
Think of it like a doorman. Most tools lock the door but give the key to anyone already inside. Wardkey asks every time: "Which program are you, and do your rules allow you to have this key?"
What it does
- Stores credentials in an encrypted vault.
- Works with Git over HTTPS (as a credential helper) and the AWS CLI (through credential_process).
- Applies rules about which app may get which credential.
- Can ask you for a Windows Hello check (face, fingerprint or PIN) on each request, when your rule says so.
- Supports decoy keys. If anything asks for one, the request is denied and logged.
- Writes every decision to a local log that detects many kinds of edits.
It's written in Go.
Honest limits
This is an early prototype, and I'd rather say so clearly:
- It cannot stop malware that is already running as you. A program running as you could try to pretend to be Git or AWS. Windows Hello approval on every request is the real protection.
- No outside expert has reviewed it yet.
- Builds are unsigned, and it's Windows-only.
- The activity log can detect many edits, but not someone deleting its last entries.
- Please test with dummy credentials only.
The full list is in the threat model in the repo.
Try it
go build -o wardkey.exe .\cmd\wardkey
wardkey help
Setup details are in the README.
Code and docs: https://github.com/Annora998/Wardkey
The code is source-available.
I'd love your feedback
Where do you think the design is weak, especially the caller checks and the approval flow? What would you want it to protect next? Tell me in the comments.
Top comments (0)