Secure dotfile governance. A mandatory, fail-closed security pipeline between your config files and git.
View on GitHubTraditional dotfile tools — stow, chezmoi, yadm — make syncing convenient. But they have zero defense against the most common infrastructure incident in the industry:
These aren't hypotheticals. Secret scanners on GitHub detect thousands of leaked credentials daily, many from dotfile repos. The problem isn't carelessness — it's that existing tools provide no guardrails.
There is no flag to skip it. No --force. No escape hatch. The pipeline is fail-closed: if any gate fails, the commit is rejected.
Only explicitly tracked files are allowed. Nothing unregistered can enter the repo.
Embedded gitleaks rules detect API keys, tokens, passwords, and known credential patterns.
Shannon entropy detection flags high-randomness strings that look like secrets, even without pattern matches.
Regex-based policy matching catches domain-specific patterns: private keys, connection strings, webhook URLs.
Sensitive files are transparently encrypted with per-file data keys and automatic rotation.
Any violation → hard rejection. No partial commits. No warnings-only mode. Pass everything, or commit nothing.
Organize dotfiles into isolated profiles — default, work, personal. Each has its own git repo, remote, manifest, and governance rules.
Detects conflicts between home, repo, and last-sync baselines. Five sync states: clean, home-modified, repo-modified, conflict, missing.
Per-file data keys with envelope encryption. Plaintext at home, ciphertext in git. Automatic key rotation on configurable schedules.
All git operations are programmatic via go-git. No shelling out means no way to bypass the governance pipeline with git flags.
Health checks for secret exposure, key rotation status, missing files, and repository integrity. Run it in CI or before a push.
Init on machine A, push to remote. Pull and apply on machine B. Encrypted files decrypt transparently with the shared master key.