Features
Features
A fleet-wide drift view that never shows a value, flags silence, and keeps each credential as narrow as the code can make it.
- 01
One page for the whole fleet
Every target’s latest state per key, plus the last 20 collector runs, on one read-only page.
- 02
Silence reads as stale
A target with no ok drift snapshot within STALE_AFTER_HOURS is flagged. A dead collector turns every target stale.
- 03
Never a secret value
The database stores 12-character fingerprints, not values. The viewer compares them on the server and sends only the verdict.
- 04
Least privilege in the database
The collector role can only insert and the viewer role can only select, with row-level security forced on every table.
- 05
Fail-closed credential scoping
Each env-sync child gets an explicit environment: the base floor plus only the credentials of the platforms in its scope.
- 06
Pre-flight against a reviewed allowlist
Before any credential is used, every service is checked against a committed allowlist and dropped if anything is unexpected.
- 07
Probes before collection
Two credential-free probes prove that the pinned env-sync enforces its platform guard before any real collection runs.
- 08
An access gate on every request
The viewer needs a Supabase session and a confirmed email on the viewer allowlist, checked on every request and again before each data read.
- 09
A CLI contract, not a library
The collector depends only on the JSON that env-sync diff --format json prints, never on env-sync’s code.
- 10
Every run is recorded
Each env-sync invocation becomes one collector run, success, partial or failed, written once at completion with its drift snapshots.
Know which secrets drifted, without seeing them
env-sync-viewer is self-hosted: you run the collector and the viewer in your own infrastructure. Access to the repository is by request.