Open, so you do not have to believe.
All of ExoSeal's code is freely readable. Anyone who uses a tool for secrets should be able to check what it does, and to run it themselves.
The license.
ExoSeal is licensed under the GNU Affero General Public License 3.0 (AGPL-3.0).
Use and operate
You may use ExoSeal freely, also commercially, on your own server.
Modify
You may adapt and extend the code.
Stay open
Whoever offers a modified version as a network service must publish the changes too.
What it is made of.
Frontend
Next.js and React, encryption in the browser with Web Crypto.
Backend
C# on .NET 10, only the backend talks to the database.
Data
PostgreSQL for secrets and requests, Valkey for short-lived counters.
Self-hosting.
One compose file, an OpenID Connect login provider and a reverse proxy are enough. Backend, database and cache run in Docker, and the backend is not reachable from the internet.
Get involved.
Bugs, ideas and improvements are welcome. The contribution guide and the public repository arrive with the first release. Until then the changelog shows the current state.