It sits in .env, in ~/.aws/credentials, in ~/.zsh_history. One compromised package or one hijacked agent, and it is gone, silently. jit locks the real values away and leaves decoys in your files. Your tools keep working. Whatever gets stolen is worthless.
jit protects your secrets from:
$ jit scan jit scan ~/ · 4 files · 1ms YOUR SECRETS: 6 — 0 protected by jit (0%) ▱▱▱▱▱▱▱▱▱▱ to 100%: one command +100% jit will protect these — 6 secrets in 4 files, 0% → 100% → jit migrate ~/.aws/credentials acme-prod/aws_secret_access_k… ~/.zsh_history GitHub Personal Access Token, AWS Access Key ID ~/acme-checkout/.env secret-shaped values ~/acme-checkout/.npmrc //registry.npmjs.org/:_authTo… No secret values are ever printed in full.
Real output, on a machine with four ordinary files on it. Nothing here is a mock-up.
jit scan looks in the same places malware looks: .env, ~/.aws, your shell history, your agent's caches. Sixty seconds, and you are looking at the full list, file and line. Then lock them away.
# install jit (macOS · Apple Silicon) $ brew install jitpass/tap/jitpass
free for personal & internal company use·no account·no telemetry·every change reversible
