CLI security is broken. The packaging layer is where we fix it. From the creator of Homebrew.
Joined May 2026
- Tweets40
- Following0
- Followers388
- Likes12
Pinned Tweet
We have documented the concept of `Reentrant Blessed Scripts` that describe our suggested mechanism of giving Agent Automations a set of escalated capabilities and secrets.
Have the automation execute a Blessed Script with Automic Vault front-matter for the capabilities and…
In the next version we detect exposure to eMudhra certificates. At multiple levels. /etc/ssl, Homebrew *and* installed apps like node, python, uv, deno etc. that may have had certificates hardcoded into their binaries.
A healthy uptick in new users due to the Vulnpocalpse. Automic Vault is one part of the steps we should all take to secure us in this new era. Bringing modern security protections to the wild-west that is the command line.
Automatic denial + spam preventing temporary deny windows. Beautiful and clear new Authorization Gate UI.
Automic Vault 4.7.0 provides an ssh-agent so you can have the same granular access controls for use of `ssh` as our other hardeners.
Let your terminal `ssh` and your agents have to ask.
Enforced at the packaging layer.
Automic Vault retweeted
In a near-future-release of Automic Vault we have added ssh-agent support.
Automatically allow ssh connections for trusted destinations. Require human approval for everything else. Human approval can happen on the iPhone app.
eg. allow your Terminal automatically and deny your agents.
You can delete the keys from ~/.ssh/ after import. Keys are properly encrypted in the keychain.
Automic Vault v4.2.0 now allows you to configure temporary write escalations to partially hide after a few seconds on the nearest screen edge.
iPhone app Testflight build 5 processing. Mainly bug fixes, but we also store canceled history so you can see what your agent was trying to do at 3 AM.
…secrets you need.
The key part is to make the script *reentrant*.
The script starts by doing some deterministic work using the secrets and Tool capabilities you have defined before handing off back to the agent with a prompt that describes how to do continue the work applying…
…agent intelligence and then how to *reenter* the script to continue deterministic work that may require Tools with escalated capabilities and secrets.
Docs here:
github.com/automic-vault/aut…
We’ve done a lot of work lately to patch hardened tools so they don’t require approval gates for scenarios that don’t use credentials. Tools like `gh` and `aws` were first class in this respect. This is now more broadly true.
So if you were getting too many gates without setting a tool’s verified launcher to a higher allowance setting, you should be able to set those gates lower once v4 is released.
Reducing friction by tying escalated authority to specific *agents* and specific *threads* with temporary grants.
Nobody else is doing this: just Automic Vault.
We’re still here! We stealth released v2 a few weeks back.
It's often the case that the first time you build an app you don’t quite have all the ideas in a row. But with v2 we think we cracked it. Stay tuned! We'll get a tweet thread out soon which gives you the details.
av 1.19.0 github.com/automic-vault/aut…
Several releases over the last few days. Most interestingly full encrypted `.env` support using @dotenvx compatible encryption. Use Automic Vault locally and dotenvx in prod.
v1.17.0 includes detection and mitigation for several new secret exposures including your github token hiding behind a simple `git` invocation.
github.com/automic-vault/aut…
