In the last post we showed that ignore rules and deny rules leave gaps. An agent that can read your home folder can read what lies there.

This is the follow-up. Find those files. Then move them.

Step 1: look for yourself

Start with a few plain commands. No tool needed.

ls ~/.ssh cat ~/.aws/credentials find ~ -name ".env" -not -path "*/node_modules/*" 2>/dev/null grep -rl "BEGIN OPENSSH PRIVATE KEY" ~ 2>/dev/null

Enter fullscreen mode

Exit fullscreen mode

Every line that prints something is a secret in a plain file. Any process that runs as you can read it. That includes an agent.

Step 2: run the import scan

Kluis has an import scan. It finds keys, passwords, seed phrases and KeePass databases in your files.

You see the list. You choose what goes into the vault.

Step 3: move them into the vault

Each secret becomes an entry. Every entry is an age file, so the format is open. Nothing is locked into Kluis.

Keys are kept in the Secure Enclave and never leave the Mac.…