jit v0.10.0 is out

Meni Tasa — Thu, 16 Jul 2026 17:07:27 +0000

jit v0.10.0 is out - hardening the vault, and teaching the agent to keep receipts.

jit is a CLI that finds the plaintext secrets scattered across your dev machine (.env files, shell exports, ~/.aws/credentials, CLI tokens), moves them into a local encrypted vault behind Touch ID, and keeps every tool working. This update hardens both halves of that story:

The vault:

🔑 jit vault rekey - rotate the master encryption key in place. Every stored secret is re-wrapped and verified before anything is written; the old key is destroyed only at the very end. Safe to interrupt at any instant, and one Touch ID approval covers the whole run.

⏪ jit vault history / restore - overwriting a secret used to destroy the old value permanently, turning a botched token rotation into real loss. Now the outgoing value is kept as an encrypted archived version, restorable behind a fresh Touch ID prompt. And rm still means gone — deleting a secret purges its history too.

🕵️ Tamper-evident storage - each encrypted file is cryptographically bound to its own name and timestamps. Swap two vault files, or edit a timestamp to "freshen" a stale credential, and decryption fails closed instead of quietly handing back the wrong secret.

📋 Clipboard hygiene — jit vault get --copy marks the value so clipboard managers don't index it, and auto-clears it after 45 seconds — without ever clobbering something you copied yourself.

The agent — now with a full paper trail:

🧾 Denied Touch ID prompts go on the record, not just approvals. A denied caller hits a cooldown before it can prompt you again. The session audit names which secret each unlock was actually used for. And jit agent log lets you read all of it, anytime — "why did that prompt appear?" now always has an answer.

Full details: https://github.com/jitpass/jit

Still early, still macOS-only, built in the open.
Feedback and issues welcome.

Every developer's laptop is a pile of plaintext secrets.

Meni Tasa — Wed, 15 Jul 2026 17:44:35 +0000

Run this: cat ~/.cache/huggingface/token

That's your Hugging Face token. Plaintext. In a cache folder the kind that ends up in backups, rsyncs, and Docker COPYs.

jit 0.8.2 fixes it in one command:▎

jit wrap hf
Token vaulted, file scrubbed, hf keeps working as if nothing changed.

jitpass / jit

jit is an free CLI that finds the plaintext secrets scattered across a Mac and converts them into just-in-time, Touch-ID-gated credentials, without breaking anything that reads them.

jitpass: the `jit` CLI

Just-in-time credentials for your dev machine.

Documentation · Quickstart · Supported tools · Command reference · Security

Introduction

The problem. A working dev machine accumulates plaintext secrets: .env files, export STRIPE_KEY=... lines in shell configs, ~/.aws/credentials kubeconfig client keys, Terraform Cloud tokens, .npmrc auth tokens, MCP server configs. Every one of them is readable by anything running as your user, gets swept into backups and file indexes, and stays on disk long after the moment you actually needed it.

What jit does. jit finds those secrets (jit audit, strictly read-only), moves them into a local encrypted vault, and rewrites each file so everything keeps working without the secret sitting on disk:

jit audit                  # what's exposed on this machine? (strictly read-only)
jit migrate local          # fix this project; tools keep working
jit wrap gh                # move a CLI's token into the vault; keep

…

View on GitHub