jit - Just-in-time secrets for your Mac
Show HN: Laptop is the last place your secrets are still in plaintext
jit is a macOS tool that finds plaintext secrets on your Mac—like API keys in .env files, AWS credentials, and shell exports—and moves them into a local encrypted vault protected by Touch ID. It rewrites configuration files so your existing tools keep working, injecting real credentials only into the specific processes that request them, after a biometric prompt. This protects against malicious scripts, sketchy npm installs, and AI agents running with your permissions. With jit, you unlock once, approve each tool's access, and leave decoy files on disk. It supports AWS, GCP, Docker, shell exports, and more, and includes an audit trail to track every access.
Your secrets live in plaintext all over your machine: .env files, ~/.aws/credentials, ~/.zshrc exports, .npmrc tokens, MCP configs. Anything running as you can read them.
- necovek
While this might be a useful tool for Mac users, it's all hackers here, so:
* Most people do not have passwords in plain text — an SSH key protected with a passphrase is not "plain text", for instance
* Most people have encrypted home or full disk encryption
* How can we trust your crypto implementation?
* If we are talking about in-memory plain-text during use, how does this tool protect against it?
* Containerisation is a big topic when running untrusted software for exactly (but not just) this reason
* While passwords/tokens might carry a big risk depending on what you do, I find that I worry more about my local data compared to my remote data — and virtualisation or containerisation helps with that.
- adamddev1
This looks like a really cool idea. But since it's a new project and has all the Claude stuff I immediately feel unsure about the solidity and reliability of a security-critical piece for software like that. I wish I could go back to my pre-LLM levels of skepticism.
- ryuuseijin
For development on linux I like to use dotenvx, which lets you put encrypted secrets in an .env file and supply the private key separately.
I have a small wrapper script [1] that prompts for the private key which allows me to paste it from my password manager and launches a shell with the env variables decrypted. This allows me to avoid storing any secrets while still having shell session open where I can terminate and restart a server process for example without having to re-enter the secret all the time.
[1] https://gist.github.com/ryuuseijin/0cf6ab852fbb18d6702933a24...
- Animats
The install procedure, for something that's supposed to be a security product:
curl -sL https://dl.jitpass.com/jitpass/jit/releases/latest/download/jitpass_darwin_arm64.tar.gz | tar -xz jit
sudo mv jit /usr/local/bin/
What could possibly go wrong?
- _august
I've moved my secrets to 1Password Environments (https://www.1password.dev/environments), which works really well for everyday use.
It works with 1password cli (https://www.1password.dev/cli) to access for agents/scripts, and I get a nice UI to manage them in the 1password app.