Secrets don't stay secret in a group chat.
A quick ask becomes a production credential copied into a channel, and nobody's quite sure which version is current — or who's reading along.
Built for the moment secrets actually leak
Not when someone breaks in, when someone pastes a key into a thread to unblock a teammate at 6pm on a Friday.
ENCRYPTION & SECURITY
Encrypted, zero-knowledge preview
Secrets stored ciphertext-only with AES-256-GCM. Cloak keeps a safe preview so your team can verify values without exposing raw credentials.
BULK .ENV IMPORT & EXPORT
1-Click .env parsing & export
Drag-and-drop or paste raw .env files to parse and populate entire project environments in seconds. Download or copy anytime.
ENVIRONMENT DIFF
Catch missing production keys
Side-by-side comparison matrix across Development, Staging, and Production. Instantly spot missing or out-of-sync keys before deployment.
VERSION HISTORY & ROLLBACK
Instant 1-click secret rollback
Every key modification creates an immutable version log. Roll back broken API rotations or accidental edits in 1 click.
ROLE-BASED ACCESS (RBAC)
Granular Owner, Admin & Viewer roles
Assign exact responsibilities. Viewers can read secrets without editing; Admins manage team access; Owners control billing.
ZERO-DATA-LOSS FREEZING
Non-destructive workspace protections
Plan downgrades pause CLI access without EVER deleting projects, secrets, or team members. Everything instantly unfreezes upon resubscription.
One shape, every service
A workspace holds your team. A project is one deployable service. Each project mirrors the environments it actually ships to. Nothing more to model.
See the full data model →Workspace
└── Project
├── development
│ ├── DATABASE_URL
│ └── RESEND_API_KEY
└── production
├── DATABASE_URL
└── RESEND_API_KEYMove your first secret in under five minutes
Free for solo projects. Upgrade when your team needs to share access.