Vault entries now have three states

Visible, use only or locked: the AI reads a value only where you release it, or works with a placeholder and never sees the real one.

User impact: Not reviewed

Each vault entry now has one of three states. With visible, the AI reads the value in plain text, but only in chats you release it for, and only when it asks. With use only, it sees a placeholder such as zlph_github-token_… and the list of hosts it may be used for. With locked, it sees and uses nothing.

The three states, and how a use-only value gets from placeholder to target host.

Text version

Visible: encrypted in the app database, decrypted per chat on request, logged. Use only: stored in the key service, which has its own key. The AI writes the placeholder and the real value is inserted outside its view, only for an allowed host. Locked: stored in the key service and never inserted.

What changes for you

Existing entries kept their meaning: those with model access are visible, all others are locked and moved to the key service. Server tools such as git and the site builder keep working. Git no longer writes its token into the repository configuration. It uses a credential helper, with repository hooks switched off.

A second net now sits in front of every request to a model provider. It looks for the real values of your entries, also as base64, hex or URL-encoded text, and replaces them with the placeholder or a short note. The browser side panel now follows the chat's retention rules too.

A placeholder is refused when it is unknown, belongs to another account, is locked, or meets a host that is not on the list. The request is not sent and the AI is told why. Values in a request body are not covered.