Secrets

Tasuku seals user-managed secret values with TASUKU_MASTER_KEY (AES-256-GCM, via WebCrypto) and stores the ciphertext in D1. Read responses expose the name, scope, timestamps, and a keyed fingerprint — never the value.

Scopes and shadowing

• Organization secret: available to configuration across the organization.
• Repository secret: available only while resolving configuration for that repository.

When both scopes contain the same name, the repository value shadows the organization value.

repository secret → organization secret → unresolved reference error

References

Supported configuration values can use ${secrets.NAME}, for example an MCP Authorization header, a Daytona API key, or an external runtime host's auth_header_template — see Sandbox providers.

Updating a value

Secret writes replace the value. Use the returned fingerprint to confirm which credential version is stored without retrieving plaintext.

Removing a repository override

In a repository's Agent tab, Use instance credential removes the current provider credential override and makes subsequent resolution use the organization credential with the same name. Tasuku permits this only when that organization fallback exists. It records the removed secret ID, name, fingerprint, version, actor, repository, time, and fallback fingerprint without retaining plaintext in the audit record.

Deletion includes the displayed active_version as expected_version. If another write rotates the override first, Tasuku returns a conflict and the page must reload before retrying. An override without a matching organization fallback is blocked, even if it has not been used recently; add the fallback first so configured references cannot become unresolved.

Organization secrets and GitHub App credentials do not expose a delete operation in this release.

Backup dependency

Back up secrets as part of a D1 export or Time Travel bookmark, and preserve the exact master key separately. A database restore without its matching TASUKU_MASTER_KEY cannot decrypt GitHub App credentials or user-managed secrets. See Backup and recovery.