The Single-Binary Micro-KMS & Universal OIDC Secret Broker.
Engineered in pure Rust. Built for homelab self-hosters with autonomous zero-config TLS 1.3, zero external databases, and zero-file process injection. Hardened for enterprise BYOC with tokenless OIDC workload identity, real-time SIEM streaming, and Prometheus fleet metrics.
docker run -d --ulimit memlock=67108864:67108864 -p 127.0.0.1:8443:8443 -v vault-data:/data ghcr.io/oakai-security/sovereign-vault:v1.0.0
Quickstart →
Core Pillars
Why developers replace bloated vault stacks with Sovereign Vault
Sub-Millisecond Engine & 15 MB RAM (Pure Rust)
Compiled to a single 8.8 MB static binary (< 32 MB container image). Zero garbage collection pauses, microsecond response times, and uses less than 15 MB of RAM under load.
Zero Accounts & Zero External Databases
No mandatory Postgres, Redis, or multi-tenant signup forms. Runs autonomously with full-page encrypted SQLCipher (`HMAC-SHA512`) storage and an HKDF-SHA512 wrapped DEK envelope.
Memory-Safe Enclave
Uses mlock() to legally forbid the OS kernel from paging secrets to unencrypted swap disks. Memory buffers are wiped on drop via hardware zeroize.
Universal OIDC Workload Federation
Eliminate static tokens in CI/CD. Authenticate GitHub Actions, Kubernetes pods, GitLab CI, and Dex/Authelia using short-lived JWTs (RS256, ES256, EdDSA) verified by pure-Rust ring.
Native TLS 1.3 & Anti-Hijack Guard
Autonomous zero-config ECDSA P-256 certificate generation encrypts wire traffic from the first millisecond. Single-use bootstrap nonces and constant-time token matching block port-scanning attacks.
Zero-.env Injection & AI Agent Native
Inject secrets into child processes directly via sovereign-vault run without ever writing a plaintext file. Full MCP agent tool support for Claude, Cursor, and Copilot.
Head-to-Head
How Sovereign Vault compares to other tools
| Capability | Sovereign Vault v1.0 | HashiCorp Vault | Infisical | Plain .env in Git |
|---|---|---|---|---|
| Binary / Image Size | 8.8 MB / 31.7 MB | 280 MB+ | 300 MB+ (3 containers) | 0 MB |
| RAM Utilization | < 15 MB | 500 MB – 1.5 GB | 400 MB+ | 0 MB |
| Wire Security (In-Transit) | ✅ Native TLS 1.3 (Auto PKI) | Requires manual certs | Requires reverse proxy | ❌ N/A |
| Workload Authentication | ✅ Dual-Mode (OIDC + Tokens) | ✅ Vault Agent / JWT | ✅ Universal Auth | ❌ Static hardcoded |
| Database Dependencies | None (SQLCipher SQLite) | Consul / Raft | PostgreSQL + Redis | None |
| Swap Page Protection | ✅ mlock() Pinned | ✅ Enabled | ❌ No (Node/Go GC) | ❌ Plaintext on Disk |
| Tamper-Evident Audit | ✅ HMAC-SHA512 + SIEM | ✅ Audit Device | ✅ Audit Logs | ❌ Zero auditing |
Research & Teardowns
Technical Whitepapers
The $90,000 Git Leak Nightmare
The mechanics of secret compromise: How GitHub scanning bots weaponize committed OpenAI & AWS API keys in under 4 minutes.
Engineering #01The RAM Swap Memory Trap
Why standard secret managers leak master keys to unencrypted swap partitions, and how we solved it in Rust using mlock() and zeroize.
Forensics #05Case Studies in Secret Leakage
Forensic analysis of major historical breaches: Dissecting Uber's AWS token, CircleCI, and Toyota's 5-year public GitHub exposure.
Why 200 Microservices Cost $78,840/Month on AWS KMS
Cloud providers charge $0.03 per 10,000 KMS requests. When hundreds of microservices query KMS directly for database credentials and API keys, the bill explodes. Sovereign Vault serves billions of queries directly from fast in-VPC RAM with zero per-query fees.
Raw AWS / GCP KMS
At 10,000 queries/second (200 services at 50 req/s), you execute 26.3 billion KMS API calls monthly. Plus, external HTTPS calls add 15ms latency and risk HTTP 429 quota throttling.
HashiCorp Vault Ent.
$25k to $60k/year in software licenses, 3 to 5 multi-node compute clusters with Consul storage, plus a dedicated SRE to perform Raft quorum repairs and unseal rituals.
Sovereign Vault BYOC
Calls Cloud KMS exactly once at cold boot to unwrap the DEK into mlock() RAM. All 26 billion microservice queries served in <1ms with zero KMS per-query fees on 100% Free Tier compute.
Deploy Into Your Private Cloud in 3 Minutes
Keep your secrets and unseal keys inside your own security perimeter. Our production Terraform module configures an isolated private VPC with zero public IPs, automated Cloud KMS envelope auto-unseal, and standard disk storage that qualifies 100% for Google Cloud's Always Free Tier.
- ✓ Zero Public IP Addresses: Ingress strictly via Cloud IAP or WireGuard
- ✓ Cloud KMS Auto-Unseal: Automated recovery with zero human unseal ceremonies
- ✓ Enterprise Identity: Native integration with Active Directory, Okta & OIDC
- ✓ Zero Vendor Access: Oakai Security possesses zero keys, routes, or tokens
module "sovereign_vault" {
source = "github.com/oakai-security/terraform-google-sovereign-vault"
project_id = "your-company-prod"
region = "us-central1"
vault_name = "acme-vault"
# 100% Free Tier (pd-standard + e2-micro)
machine_type = "e2-micro"
disk_type = "pd-standard"
disk_size_gb = 30
subnet_cidr = "10.10.0.0/24"
}Apply complete! Resources: 17 added. Monthly compute cost: $0.00.
Multi-Cluster Fleet Governance, SSO & Cloud KMS Auto-Unseal
The core Sovereign Vault engine is 100% free and Apache 2.0 open-source forever. Join the early-access waitlist for Oakai Security Cloud: our zero-knowledge BYOC control plane where secrets and unseal keys never leave your private VPC.
- ✓ Local VPC Auto-Unseal (AWS KMS, GCP KMS, Azure KV, TPM 2.0)
- ✓ Ed25519 Admin Policy Signing & Instant Global Token Revocation
- ✓ Okta / OIDC SSO, SOC 2 / HIPAA Audit Exports & Litestream S3 DR
Join the Enterprise BYOC Waitlist
Reserve design-partner pricing and early access to the v1.0 Fleet Control Plane.
Ready to eliminate .env credential leaks?
Spin up the single-binary container on Docker in 15 seconds. Wire-encrypted with TLS 1.3 by default.