Secure Credential Storage

Picks the Right Brain for the Job · Shipped · workstation, home

Encrypted vault for API keys and provider secrets — never stored in plaintext config files.

Provider API keys, Home Assistant tokens, and other secrets are stored in an encrypted credential vault rather than plaintext YAML. The vault is keyed to the local machine identity.

The crypto storage module handles encryption at rest, key derivation, and secure retrieval. Secrets are never logged, never included in debug output, and never transmitted to the model as part of conversation context.

Limits and invariants

Keys are never rendered in debug logs or included in model prompts. The picker UI masks API keys in the provider card display.

Where this lives

• halbert_core/halbert_core/crypto/storage.py