Show HN: jit Moves Developer Secrets Into a Touch ID Vault and Serves Decoy Values to Unauthorized Readers — Including Agents
45 points and 66 comments on HN, pitched as 'your laptop is the last place your secrets are still in plaintext.' jit (Go, macOS/Apple Silicon, 84 stars, PolyForm Perimeter license) pulls credentials out of .env files, ~/.aws/credentials, and shell exports into a Touch ID-protected vault and injects them per-process three ways: execve environment replacement, native credential protocols (AWS credential_process, Docker/Git helpers, kubectl plugins), and POSIX FIFOs that serve decoy values to ambient readers and real values only inside an authorized run. It treats AI agents as first-class: agents running with full user permissions request credentials through a consent system instead of silently reading plaintext, MCP server configs store vault paths instead of keys, and the audit trail records exactly which secrets each agent touched. Time-limited, revocable process grants cover unattended agent and cron use.
↳ Follow the thread