Secrets

Tasuku encrypts user-managed secret values with TASUKU_MASTER_KEY and stores ciphertext in Postgres. Read responses expose the name, scope, timestamps, and keyed fingerprint—not the value.

Scopes and shadowing

• Instance secret: available to configuration across the organization.
• Repository secret: available only while resolving configuration for that repository.

When both scopes contain the same name, the repository value shadows the instance value.

repository secret → instance secret → unresolved reference error

References

Supported configuration values can use ${secrets.NAME}, for example an MCP Authorization header or Daytona API key.

Updating a value

Secret writes replace the value. Use the returned fingerprint to confirm which credential version is stored without retrieving plaintext.

Removing a repository override

In a repository's Agent tab, Use instance credential removes the current provider credential override and makes subsequent resolution use the organization credential with the same name. Tasuku permits this only when that organization fallback exists. It records the removed secret ID, name, fingerprint, version, actor, repository, time, and fallback fingerprint without retaining plaintext in the audit record.

Deletion includes the displayed active_version as expected_version. If another write rotates the override first, Tasuku returns a conflict and the page must reload before retrying. An override without a matching organization fallback is blocked, even if it has not been used recently; add the fallback first so configured references cannot become unresolved.

Organization secrets and GitHub App credentials do not expose a delete operation in this release.

Backup dependency

Back up secrets as part of Postgres and preserve the exact master key separately. A database restore without its matching TASUKU_MASTER_KEY cannot decrypt GitHub App credentials or user-managed secrets.