Skip to content
Create free account
Create free account

Early accessTeams, machines and CI

Share secrets with your team, not the server.

One vault for your team’s .env files, API keys and cloud credentials. Values are encrypted on your devices, and the server stores only ciphertext.

Free during early access, with nothing to pay.

See how it works
Example. Kiteline is a fictional company.

One vault for every environment

Projects hold environments, and each environment has its own key. People, machines and CI pipelines get only the environments they’re granted.

Install it once.Every environment you grant this machine later reaches it through the same agent.
On your machineapi-prod-1 · linux/amd64
crunu enroll --server https://app.crunu.com -
crunu run --env payments-api/production \
  -- node server.js
  • Enroll with a one-time code. It burns on first use; a second try raises an alert.
  • Approve the machine after comparing the fingerprint that crunu enroll prints.
  • The agent keeps decrypted environments in memory and hands them to your process.

Set up in three steps

Start on app.crunu.com with the .env files your team already has. People need only a browser; the agent is for machines and CI.

  1. 1Create a vault

    Create a project and drag in your .env files, or whole folders like .aws. Crunu reads the variables and suggests where each file lives.

  2. 2Invite your team

    Send an invitation link and compare a key fingerprint with each new member before granting access. Roles are set per environment.

  3. 3Run with crunu run

    Enroll a machine with a one-time code, approve it after the fingerprint check, and start your app with crunu run.

People, machines and CI — one source

Your team opens environments in the browser. Machines and CI jobs get them through the Crunu agent. Both decrypt the same ciphertext with the same cryptography, so nobody passes .env files around.

  • Each machine has its own keys

    A key on one machine opens nothing on another. Revoke a machine and the environment keys it held are rotated.

  • CI bound to a repository

    Bind a service token to one repository and branch with OIDC. A leaked token on its own is refused.

  • Works through an outage

    If the network drops, the agent serves the last verified state until its lease ends, 24 hours by default.

Machines in detailCI/CD in detailExample. Kiteline is a fictional company.

Someone leaves. Every key they held is replaced.

Removing a member is one guided flow. The server stops serving them the moment they are removed.

  • See what they received

    The exposure report lists which versions of which environments the person fetched, when and from which address.

  • Rotate their keys

    Crunu replaces the key of every environment they had and revokes what they could still use: service tokens, share links, invitations and enrollment codes.

  • Reissue at the provider

    A checklist names each value to replace at its provider, without showing the values.

  • Seen values stay seen

    Rotation protects every new version. Values they already saw stay valid until you reissue them, which is what the checklist is for.

What holds even if the server is compromised

Each claim names the mechanism behind it, so it doesn’t depend on trusting whoever runs the server.

  • A stolen database doesn’t reveal values

    Your account key comes from your password and a Secret Key that never reaches the server, so a full copy of the database is useless for guessing.

  • The server can’t grant itself access

    Who may read an environment is a document signed by an admin, and every version is signed by its author. Browsers and agents check both.

  • Edits to the audit log show

    Entries form a hash chain, so an edit, deletion or insertion breaks verification. Export the log as JSONL to check it outside Crunu.

Free during early access

Every feature is included while Crunu is in early access. These are the current limits.

  • Environment size

    All files of one environment together.

    1 MB

    per environment

    1,048,576 bytes
    • .env, INI and flat YAML by field
    • Any other text file whole

  • Version history

    Every save is a new version.

    100versions

    per environment

    up to 64 MB of history
    • Author and time on every version
    • Restore an old version as a new one

  • Early accessNow

    Every feature, in our cloud on app.crunu.com.

    Free

    Nothing to pay

    Create free account
    • Browser app and Crunu agent
    • Machines and CI service tokens
    • Access requests and offboarding
    • Audit log and alerts

  • Projects

    Each project holds its environments.

    500projects

    per organization

    up to 50 environments each
    • Each environment has its own key
    • And its own access list

  • Access list

    Who can read one environment.

    5,000entries

    per environment

    people, machines, tokens
    • Editor, Reader, Specific files
    • Operator for machines
No card and no sales call. You create the account yourself.Pricing in detail

Before you move your secrets

What teams usually check before they move their .env files.

Something else? Write to support@crunu.com

What can the server see?

One encrypted record per version of each environment, plus public keys and signed documents. It also sees metadata: the names of organizations, projects, environments and machines, member emails, the audit log, and the size and time of each version. Variable names and values exist only inside the ciphertext, and your password and Secret Key are never sent at all.

What if I forget my password or lose my Secret Key?

There is no password reset, because the server can’t perform one. Your recovery code opens the account after a waiting period, one hour by default; the account holder is notified, and a normal sign-in cancels the attempt. An admin can also move your personal environments to a new account. Keep the Emergency Kit you print at sign-up somewhere safe.

How much does Crunu cost?

Crunu is free during early access, with every feature included. Current limits: 1 MB per environment, the last 100 versions of history up to 64 MB, 500 projects per organization, 50 environments per project, and 5,000 entries in an environment’s access list.

Can I run the server myself?

Yes. It runs in Docker on a machine of your own, on Cloudflare Workers, Vercel, Google Cloud Run or AWS App Runner, though AWS has closed App Runner to new customers. A self-hosted server moves between platforms with one archive that contains no plaintext values. On Cloudflare, a team needs the Workers Paid plan.

Which CI systems does it work with?

GitHub Actions, GitLab CI and Bitbucket Pipelines, with OIDC binding to the repository, branch and deployment environment. Any other OIDC issuer works through a generic provider. A CI system without OIDC can use a service token stored in its secrets together with crunu run.

Which operating systems does the agent support?

Linux and macOS, on amd64 and arm64. On Linux the agent can run as a systemd service that keeps environments in memory. On macOS it works from the command line, for people and service tokens. Windows is not supported. The web app needs Chrome 113, Safari 17, Firefox 129 or newer.

Can I bring secrets over from another tool?

Drag in .env files, INI files such as ~/.aws/credentials, flat YAML or any text file, including whole folders like .aws, up to 300 files at once. Crunu reads the variables and suggests where each file lives on disk. There is no direct import from 1Password, HashiCorp Vault, Doppler or Infisical.

Does revoking a machine take effect right away?

The server stops serving it at once, and the keys of the environments it held are rotated. The agent erases its copy within minutes while the machine is online, since it checks in every minute by default. An offline machine stops when its lease ends, 24 hours by default. A process that is already running keeps its variables until it restarts.

Take your .env files out of the chat

Create your account on app.crunu.com: confirm your email, set a password and save the Emergency Kit with your Secret Key.

Free during early access. Read the security model