New macOS tool encrypts dev machine secrets in place with biometric gating

jitpass addresses a long-standing operational risk: plaintext credentials scattered across configuration files, environment files, and shell profiles. The tool scans the home directory, identifies secrets, and migrates them into an encrypted vault. On-disk files are replaced with decoys, while the real values are only exposed in memory to the specific process that requested them after a Touch ID prompt. This reduces the attack surface to the lifetime of a single process rather than the entire session.

The migration process is designed to be non-disruptive. Engineers run `jit migrate` once, review the plan, and confirm with a biometric prompt. After migration, tools like `aws`, `terraform`, `gh`, and `docker` continue to work without modification. Credentials are injected transparently at runtime, so existing scripts and CI/CD pipelines that rely on these tools do not need changes. The tool also supports wrapping CLI tools that manage their own tokens, ensuring even those credentials are protected.

Adoption costs are minimal for the target platform but come with clear limitations. The tool is macOS-only and currently supports only Apple Silicon, requiring Intel Mac users to compile from source. Installation is straightforward via Homebrew or a signed tarball, but engineers must ensure only one installation method is used to avoid conflicts. The tool also relies on Apple’s security infrastructure, including the login keychain and Touch ID, which may not be available in all environments or for all users.

The security model assumes trust in the local machine and the user’s biometric authentication. If the machine is already compromised, an attacker with root access could potentially intercept the decrypted secrets in memory. Additionally, the tool does not protect against phishing or social engineering attacks that trick users into approving credential access. Engineers must still rotate credentials that may have been exposed and follow best practices for secret management, as the tool does not eliminate the need for secure credential handling entirely.