Concepts

Eight words, and they nest: a namespace holds profiles, a profile holds keys, and a key holds either a secret, which lives in the vault and is never printed, or a value, which was never worth hiding and sits in the file beside the name. A key is only a name, which is what makes the file safe to commit.

Two files carry them, and only one is committed:

Where these sit and who can read them is how it works.