{
  "id": 1223174,
  "title": "Show HN: Laptop is the last place your secrets are still in plaintext",
  "url": "https://urgent.news/2026/08/16/show-hn-laptop-is-the-last-place-your-secrets-are-still-in-plaintext",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-16T06:55:04.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://github.com/jitpass/jit"
  },
  "original_language": "en",
  "account": "Laptop remains the sole location where secrets remain in plaintext on your dev machine. These secrets include .env files, AWS credentials, Zsh exports, npm tokens, and MCP configurations. Any process running with your permissions can access these secrets. Just-in-Time (JIT) encryption moves each secret into a local vault protected by Touch ID, rewriting the files so your tools continue working. A decoy file remains on disk, containing the real value only when a process requests it after a biometric prompt. This single unlock authorizes access for the specific process that requests it. Homebrew installs the shell completion, enabling seamless access to subcommands, flags, and tool names. Running `jit scan` without a path scans the entire home directory, while `jit scan` with a path scans a specific location. The tool primarily uses `jit run -- cmd` for most CLI interactions, automatically wrapping CLI tokens when necessary. The tool scans all files and categorizes them into what it protects and what requires manual handling. The tool requires no setup for AWS, shell login, and Docker registry logins, as these can request secrets directly. Other tools requiring runtime files can ask for secrets manually. Certain tools need explicit setup, such as `--with name` for scripts and CI where no prompt exists. The tool includes two Touch ID prompts: Gate 1 unlocks the vault, while Gate 2 prevents unauthorized use of unlocked secrets by other processes. An optional third grant allows unrestricted access for a specific timeframe. Detailed process grants provide a log of each command and unlock event, enabling audit trails.",
  "summary": null,
  "key_points": [
    "Laptop remains sole location for plaintext secrets in dev environment",
    "JIT encryption protects secrets with Touch ID, rewrites files",
    "jit scan scans home directory, categorizes protected vs manual secrets"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}