Skip to content
valetkey

Security model

This page is deliberately blunt. A tool that hands sessions to AI agents should be honest about what it does and does not protect.

What valetkey guarantees

Section titled “What valetkey guarantees”

Root credentials never enter your agent’s context. That covers passwords, provider secret keys, JWT signing secrets, and magic links. They live encrypted in the vault, decrypt only inside the valetkey process, and every decrypted value is scrubbed from command output, error messages, MCP responses, and the audit log. The agent cannot read what it was never given.

What the agent holds

Section titled “What the agent holds”

The session artifact is itself a credential. There is no way around that; a browser that is signed in carries something that makes it signed in. valetkey limits what that is worth:

  • Sessions expire after 60 minutes by default (configurable, and refresh is one login away).
  • Cookies are pinned to your configured dev origins, so they never ride along to other sites the agent visits.
  • Origins are restricted to local and explicitly allowlisted dev hosts. valetkey refuses to mint against anything that looks like production.
  • Artifacts live outside your repo with 0600 permissions, so project-scoped file reads never see them.
  • The managed browser is a profile of its own, holding your dev app’s sessions and nothing else. Your personal Chrome is untouched.
  • valetkey logout revokes, deletes, and clears the browser, and the audit log records every mint, injection, and export.

What valetkey cannot do

Section titled “What valetkey cannot do”

A compromised or prompt-injected agent can use a valid session for whatever the session allows, for as long as it is valid. If the agent browses untrusted content while holding a session, injected instructions could act as the signed-in user on your dev app. valetkey bounds the damage window; it does not remove it.

Practical hardening

Section titled “Practical hardening”
  • Keep dev databases free of real user data. The best mitigation is having nothing worth stealing.
  • Use short TTLs for sensitive work: session: { ttlMinutes: 15 }.
  • Add a deny rule so your agent cannot read artifact files directly. For Claude Code, deny Read(**/.valetkey/**) and reads of ~/.valetkey/ in your settings.
  • Run valetkey logout when a work session ends.
  • Never add a production origin to allowRemoteDevOrigins. The allowlist exists for staging environments, and staging should hold staging data.