Feature
Fail-closed credential scoping
Each env-sync child gets an explicit environment: the base floor plus only the credentials of the platforms in its scope.
A platform rule lists the exact variable names a platform may receive. Everything not in the base floor or in a rule for the child’s scope is withheld, including the collector’s own DATABASE_URL.
Each child also gets a fresh empty HOME and ENV_SYNC_ALLOWED_PLATFORMS, so env-sync itself refuses any target outside the scope before it reads a credential.
This is credential scoping, not process isolation: a child running as the same user could still read the collector’s environment from the operating system. The collector is meant for a dedicated CI environment for that reason.
More features
All features →- 01
One page for the whole fleet
Every target’s latest state per key, plus the last 20 collector runs, on one read-only page.
- 02
Silence reads as stale
A target with no ok drift snapshot within STALE_AFTER_HOURS is flagged. A dead collector turns every target stale.
- 03
Never a secret value
The database stores 12-character fingerprints, not values. The viewer compares them on the server and sends only the verdict.