Briarlock Developer

Developer Guide

How to find SSH keys and environment secrets on this device, save them in the vault, and use them in a build.

Why

A private key or a token in a file is plaintext. Anything that can read that folder can read the secret. Import copies it into Developer. The file on disk is left as it is.

Where

Check Location Shown
SSH keys A .ssh folder you choose, up to three folders deep. .pub files and names in .ssh/.ignore are skipped. The path and the alert.
Environment files .env, .env.local, and .env.production in a project folder you choose. Dependency folders are skipped. The count and the names, not the values.
Vault Logins, notes, and custom fields. Secrets already saved under Developer are not reported as leaks. The item and the kind of key.

How

  1. 1

    Step 1. Open Developer

    In the vault sidebar, select Developer. Use Secrets, Scans, Builds, or AI tools.

  2. 2

    Step 2. Scan the SSH folder

    On Scans, select Scan .ssh folder and choose the directory.

  3. 3

    Step 3. Act on the SSH alert

    Use the alert table below. Import is offered only when the key can be saved.

  4. 4

    Step 4. Scan a project folder

    Select Scan a project folder. An .env file is listed only when a line looks like a secret.

  5. 5

    Step 5. Import

    Select Import. The secret is saved under Developer. Delete the disk copy yourself when you no longer need it.

  6. 6

    Step 6. Use a secret in a build

    On Builds, download briarlock.env and briarlock-run.mjs. The page shows names only. Do not commit either file.

    node briarlock-run.mjs -- your-command
  7. 7

    Step 7. Set AI tools

    Allow all, Review all, or Block all covers known tools. The block list covers a site anyway, including one that appeared today. The allow list keeps a site open. Block covers the tool until you continue for that tab. Visits are not recorded.

Alerts

Alert Meaning What to do
Insecure key type DSA, or RSA under 2048 bits. Generate a new key. Delete the file yourself. This key is not imported.
This key is unencrypted The private key is plaintext on disk. Select Import, then delete the plaintext file yourself.
Import into Briarlock The key is encrypted and supported. Import keeps a copy in Developer.
Already in Briarlock The same key is already saved. Keep the vault copy. Delete the extra file if you do not need it.

Listed in an .env file

  • Names such as a token, password, or key
  • A value that matches a known key pattern
  • A URL that includes a username and password

Not listed

  • NODE_ENV=development
  • A bare port or host
  • Files inside dependency folders

Limits

Briarlock does not walk the rest of the disk, upload the files, or delete them. A company-wide scan is a conversation, not a switch in the vault.