The Single-Binary Micro-KMS & Universal OIDC Secret Broker.
Engineered in pure Rust. Built for homelab self-hosters with autonomous zero-config TLS 1.3, zero external databases, and zero-file process injection. Hardened for enterprise BYOC with tokenless OIDC workload identity, real-time SIEM streaming, and Prometheus fleet metrics.
docker run -d --ulimit memlock=67108864:67108864 -p 127.0.0.1:8443:8443 -v vault-data:/data ghcr.io/oakai-security/sovereign-vault:v0.3.0
Quickstart →
Core Pillars
Why developers replace bloated vault stacks with Sovereign Vault
Sub-Millisecond Engine & 15 MB RAM (Pure Rust)
Compiled to a single 8.8 MB static binary (< 32 MB container image). Zero garbage collection pauses, microsecond response times, and uses less than 15 MB of RAM under load.
Zero Accounts & Zero External Databases
No mandatory Postgres, Redis, or multi-tenant signup forms. Runs autonomously with full-page encrypted SQLCipher (`HMAC-SHA512`) storage and an HKDF-SHA512 wrapped DEK envelope.
Memory-Safe Enclave
Uses mlock() to legally forbid the OS kernel from paging secrets to unencrypted swap disks. Memory buffers are wiped on drop via hardware zeroize.
Universal OIDC Workload Federation
Eliminate static tokens in CI/CD. Authenticate GitHub Actions, Kubernetes pods, GitLab CI, and Dex/Authelia using short-lived JWTs (RS256, ES256, EdDSA) verified by pure-Rust ring.
Native TLS 1.3 & Anti-Hijack Guard
Autonomous zero-config ECDSA P-256 certificate generation encrypts wire traffic from the first millisecond. Single-use bootstrap nonces and constant-time token matching block port-scanning attacks.
Zero-.env Injection & AI Agent Native
Inject secrets into child processes directly via sovereign-vault run without ever writing a plaintext file. Full MCP agent tool support for Claude, Cursor, and Copilot.
Head-to-Head
How Sovereign Vault compares to other tools
| Capability | Sovereign Vault v0.3 | HashiCorp Vault | Infisical | Plain .env in Git |
|---|---|---|---|---|
| Binary / Image Size | 8.8 MB / 31.7 MB | 280 MB+ | 300 MB+ (3 containers) | 0 MB |
| RAM Utilization | < 15 MB | 500 MB – 1.5 GB | 400 MB+ | 0 MB |
| Wire Security (In-Transit) | ✅ Native TLS 1.3 (Auto PKI) | Requires manual certs | Requires reverse proxy | ❌ N/A |
| Workload Authentication | ✅ Dual-Mode (OIDC + Tokens) | ✅ Vault Agent / JWT | ✅ Universal Auth | ❌ Static hardcoded |
| Database Dependencies | None (SQLCipher SQLite) | Consul / Raft | PostgreSQL + Redis | None |
| Swap Page Protection | ✅ mlock() Pinned | ✅ Enabled | ❌ No (Node/Go GC) | ❌ Plaintext on Disk |
| Tamper-Evident Audit | ✅ HMAC-SHA512 + SIEM | ✅ Audit Device | ✅ Audit Logs | ❌ Zero auditing |
Research & Teardowns
Technical Whitepapers
The $90,000 Git Leak Nightmare
The mechanics of secret compromise: How GitHub scanning bots weaponize committed OpenAI & AWS API keys in under 4 minutes.
Engineering #01The RAM Swap Memory Trap
Why standard secret managers leak master keys to unencrypted swap partitions, and how we solved it in Rust using mlock() and zeroize.
Forensics #05Case Studies in Secret Leakage
Forensic analysis of major historical breaches: Dissecting Uber's AWS token, CircleCI, and Toyota's 5-year public GitHub exposure.
Multi-Cluster Fleet Governance, SSO & Cloud KMS Auto-Unseal
The core Sovereign Vault engine is 100% free and Apache 2.0 open-source forever. Join the early-access waitlist for Oakai Security Cloud—our zero-knowledge BYOC control plane where secrets and unseal keys never leave your private VPC.
- ✓ Local VPC Auto-Unseal (AWS KMS, GCP KMS, Azure KV, TPM 2.0)
- ✓ Ed25519 Admin Policy Signing & Instant Global Token Revocation
- ✓ Okta / OIDC SSO, SOC 2 / HIPAA Audit Exports & Litestream S3 DR
Join the Enterprise BYOC Waitlist
Reserve design-partner pricing and early access to the v1.0 Fleet Control Plane.
Ready to eliminate .env credential leaks?
Spin up the single-binary container on Docker in 15 seconds. Wire-encrypted with TLS 1.3 by default.