Feature
Never a secret value
The database stores 12-character fingerprints, not values. The viewer compares them on the server and sends only the verdict.
env-sync reports a fingerprint per key: the first 12 hex characters of a SHA-256 of the value. The collector stores the expected and actual fingerprint; there is no column for a value.
The viewer builds a minimal fleet view on the server. It holds key names and key states, and never a fingerprint, so the browser cannot see or compare them.
Key names are shown, so a viewer user can see which keys exist on a target.
More features
All features →- 01
One page for the whole fleet
Every target’s latest state per key, plus the last 20 collector runs, on one read-only page.
- 02
Silence reads as stale
A target with no ok drift snapshot within STALE_AFTER_HOURS is flagged. A dead collector turns every target stale.
- 03
Least privilege in the database
The collector role can only insert and the viewer role can only select, with row-level security forced on every table.