Security Architecture
MeowPass encrypts every secret at rest and controls access with SSO, per-request scopes, and an audit log. This page explains how that works. MeowPass is not zero-knowledge: on an authorized request, the server decrypts a secret to serve or inject it.
Encryption at rest (envelope)
# Per-secret data key (DEK)
Secret Value → encrypted with a unique data encryption key via AES-256-GCM
# Key wrapping (KEK)
DEK → wrapped with a key encryption key held on the server via AES-256-GCM
# In transit
Values travel over TLS 1.3, encrypted on write and decrypted on an authorized read.
Each secret is encrypted with AES-256-GCM using a unique data encryption key. That data key is wrapped by a key encryption key held on the server. Rotating the key encryption key re-wraps the data keys without re-encrypting every secret. MeowPass is not zero-knowledge: on an authorized request, the server decrypts a secret to serve or inject it.
Access control
Identity & authorization
- • WorkOS AuthKit (SSO, MFA and passkeys)
- • Access scoped per request
- • Agents are distinct identities with their own policy
- • Sensitive tools wait for a human to approve
Agent isolation
- • Real provider keys added server-side
- • Agents get brokered sessions, not raw keys
- • Short-lived native tokens where supported (GitHub App, AWS STS)
- • Every brokered call is logged
Cryptographic parameters
| Secret cipher | AES-256-GCM (authenticated encryption) |
| Key model | Envelope: per-secret DEK wrapped by a server KEK |
| KEK source | Server-managed key (KMS-bound in production) |
| Identity | WorkOS AuthKit (RS256 / JWKS) |
| Transport | TLS 1.3 |
| API keys | SHA-256 hashed, scoped (least-privilege) |
Infrastructure Security
- API: AWS Lambda (arm64) behind API Gateway with rate limiting
- Database: Neon Postgres, encrypted at rest
- Transport: All API traffic uses TLS 1.3
- Auth: WorkOS AuthKit (browser loopback auth-code for the CLI, hosted auth-code for the web)
- API keys: SHA-256 hashed before storage, with explicit scopes
- Audit: Every secret and broker action recorded with the actor, IP, and time
Open Source
The encryption, authorization, and broker code is public:
- pkg/secretcrypto/: server-side envelope encryption (DEK/KEK)
- pkg/authz/: per-request scope matcher
- api/handler/broker.go: the credential broker (proxy and native modes)