Secrets management for humans and agents
NiSTAR (Hebrew: נִסְתָּר — "hidden") is the secrets management platform we are building for a world where AI agents need credentials too — and need them governed, audited, and revocable, not pasted into a prompt.
WHAT IT IS
A self-hosted vault for secrets, memos, certificates, key pairs, and OTPs — with per-item versioning, hierarchical folders, typed relations between credentials (so you can see blast radius before rotating), and role-based access that fails closed.
What sets it apart is the threat model: sensitivity tiers decide what a human sees, what an agent may broker, and what never leaves the vault at all. Every access lands in a hash-chained, tamper-evident audit log. Approval-gated reveal means an agent can hold a reference to a credential without ever holding the credential.
WHERE IT STANDS
Core platform and vault domain are built — Go backend, PostgreSQL, React frontend, full CI/CD with security gates — and the approval workflow is in active development. We will publish more when there is something you can run. If secrets governance for AI agents is a problem on your desk today, talk to us — the design conversations are usually the useful part.
Credentials in prompts are a breach waiting.
If your agents need secrets, they need a vault with tiers, audit, and revocation — not a config file. Let's talk about what that looks like for your stack.