End-to-end encrypted secret sync for developer teams. Stop Slacking your .env.
Website: getsotto.co.uk · Service status: status.getsotto.co.uk
Warning
Sotto is pre-1.0 and has not had a third-party cryptographic audit. See SECURITY.md.
flowchart LR
subgraph devices["Devices - plaintext and keys stay here"]
direction TB
cli["sotto CLI - init, set, run, share"]
web["Browser vault - the same core via WASM"]
core["sotto-core - KDF, XChaCha20-Poly1305 envelopes, X25519 sealed-box grants, rotation"]
cli --> core
web --> core
end
subgraph server["Server and network - ciphertext it cannot read"]
direction TB
api["Sync API - versioned writes, per-member grants, audit log"]
db[("Postgres - envelopes and grants")]
api <--> db
end
core -- "encrypted envelopes" --> api
core -- "sealed grants" --> api
core -- "one-time shares" --> api
style server stroke-dasharray: 5 5
Everything left of the dashed boundary holds keys and plaintext. Everything right of it only ever sees ciphertext - including the database if stolen.
| I want to… | Start here |
|---|---|
| Try it on my machine | curl -fsSL https://raw.githubusercontent.com/getsotto/sotto/main/install.sh | sh or another install route, then the quick start. No account needed |
| Sync with my team without running a server | Sotto Cloud at getsotto.co.uk; sotto login uses it by default |
| Run my own server | One-command deploy in deploy/README.md |
| Use it in CI | sotto-action and a machine token |
| Contribute | CONTRIBUTING.md, then a good first issue |
| Repo | What it is |
|---|---|
| sotto | CLI, sync server, web client, and the shared crypto core |
| sotto-action | Install the CLI in GitHub Actions |
| sotto-example | Try Sotto locally: one secret, eight languages, no account |
| homebrew-tap | Homebrew formula for the CLI on macOS (preview) |
| sotto-vscode | Run VS Code tasks through the CLI (preview, not yet on the Marketplace) |
Security model in 30 seconds
- Zero knowledge sync: the server sees ciphertext plus minimal metadata, never plaintext or usable keys.
- Teams: organisations with roles, per-member environment grants, key rotation on member removal, machine tokens for CI, an audit log, and an account reset for a lost Emergency Kit.
- Honest limits: metadata exposure, the server acting as the key directory until key transparency arrives, and the weaker assurance of the served browser client are all documented in THREAT-MODEL.md.
- Report vulnerabilities privately per SECURITY.md, never as a public issue.
First contribution in 5 minutes
- Fork and clone sotto.
- Pick a good first issue - docs and CLI help-text issues need no cryptography knowledge.
- If you change the README, update its four translations in the same commit; CI checks that they stay in sync.
- Sign off every commit with
git commit -s(Developer Certificate of Origin). - Questions that are not bugs belong in Discussions.