Liberty
Hardware-bound secret manager (no more .env files)
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
I got tired of: - .env files committed to Git (seen it happen 100+ times) - API keys shared in Slack - Wondering who has access to what secretsSo I built Liberty - a CLI tool that replaces .env files with hardware-bound encryption.How it works: $ pip install liberty-secrets $ liberty add DATABASE_URL postgresql://... $ liberty add STRIPE_KEY sk-... $ liberty exec npm start Secrets are encrypted with a key derived from your machine's hardware (CPU ID + machine ID + disk serial). If someone steals your .liberty vault file, it's useless on their machine.Features: - Hardware-bound AES-256-GCM encryption - Complete audit trail (compliance-ready) - Works offline (no servers, no accounts) - Global vault (~/.liberty/ works from any directory) - MIT licensed, free for individual use GitLab: https://gitlab.com/deciphergit/libertyPyPI: https://pypi.org/project/liberty-secrets/Team features (secret sharing) coming soon as paid tier.Feedback welcome!
HN · launched Jan 14, 2026 · 7 upvotes (top 65%) · 0 views
Niche: credential management and security tools · 78 launches, 14 in the last 7 days ▲ +56% · Explore this niche →
Category and tags
- Security
- Dev tools
- Developer
- Not AI
- Commercial product
More like this: all 78 launches in credential management and security tools →
Could you build this?
Partial A basic CLI for secret storage is simple, but integrating genuine hardware-bound cryptographic security across platforms requires low-level TPM, Secure Enclave, or hardware key APIs.
What it would actually take: A production version requires platform-specific cryptographic bindings to Apple Secure Enclave (via CryptoKit/Keychain), Windows TPM (via CNG/TBS), and Linux TPM 2.0 (tpm2-tss), falling back to FIDO2/U2F devices. The hard part is securely handling hardware-backed key attestation, key generation policies, and avoiding side-channel leaks across heterogeneous OS environments. This requires a systems security engineer familiar with platform cryptographic providers and hardware security modules.
Discussion
4 comments analyzed.
Competitors mentioned: Windows DPAPI, OS secret storage APIs, password managers
Concerns raised: Low entropy from CPU ID, machine ID, and disk serial, Risk of permanent lockout from hardware upgrades or failures, Secrets should still be stored in password manager as backup, Methodology and underlying keys could be reverse-engineered by malware
Feature requests: Default DATABASE_URL to localhost and secrets to dummy strings, Integrate with OS native secret storage APIs, Generate random key and store in config directory instead of hardware identifiers, Store context name in .liberty file for secret retrieval
Competitors
Other products that read as similar to this one : 419 launches clear the similarity bar, closest 8 shown.
Attention rank: #222 of 420 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 76 days after the earliest competitor.
- Lockenv · hn · 2025-12-08 · 105 upvotes · similarity 0.60
- KeyEnv · hn · 2026-01-18 · 5 upvotes · similarity 0.59
- secure-vault-manager · github · 2026-11-10 · 102 upvotes · similarity 0.57
- SnapEnv · ph · 2026-09-14 · 3 upvotes · similarity 0.55
- kaspersky-password-manager-vault · github · 2026-11-10 · 102 upvotes · similarity 0.55
- KeeperPass · ph · 2026-09-23 · 8 upvotes · similarity 0.54
- KeyEnv · ph · 2026-10-12 · 1 upvotes · similarity 0.52
- SecretEnv · hn · 2026-05-05 · 5 upvotes · similarity 0.52
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.