Sicherheit
Vault entries now have three states
Visible, use only or locked: the AI reads a value only where you release it, or works with a placeholder and never sees the real one.
Each vault entry now has one of three states. With visible, the AI reads the value in plain text, but only in chats you release it for, and only when it asks. With use only, it sees a placeholder such as zlph_github-token_… and the list of hosts it may be used for. With locked, it sees and uses nothing.
Text version
Visible: encrypted in the app database, decrypted per chat on request, logged. Use only: stored in the key service, which inserts the real value outside the app server and the box, only for an allowed host. Locked: stored in the key service and never inserted.
What changes for you
Existing entries kept their meaning: those with model access are visible, all others are locked and moved to the key service. Git no longer writes its token into the repository configuration; its credential helper hands the box only a placeholder.
A second net sits in front of every request to a model provider. It replaces the real values of your entries, also as base64, hex or URL-encoded text, with the placeholder or a short note.
A placeholder is refused when it is unknown, belongs to another account, is locked, or meets a host that is not on the list. The request is not sent and the AI is told why. The key service inserts the value in the URL, in headers and in small JSON, form or text bodies. In a command, a placeholder stays a placeholder.
Where this stops
Use only works for HTTPS and Git targets; for databases and SSH, pick visible or locked. Server tools such as the registrar still read one value for their own call, one entry at a time, and every read is logged. Only you set the allowed hosts, not the AI.