SSP/flight

Metadata only · Read only

Know your secrets line up before deploy.

Compare declared key names with every destination. Catch gaps, stale keys, likely renames, and hard provider limits—without touching a secret value.

Install the CLI Run a local demo
  • No tokens
  • No network calls
  • Stable CI exits
Four dark geometric configuration layers with aligned key-shaped cells, one missing cell, one displaced coral cell, and an amber capacity boundary.
Four layers. One contract.
Missing keysExcess keysLikely renamesProvider limitsDelete policy

A read-only safety layer

The truth is a contract, not a console.

sspf keeps ownership explicit: your repository declares the expected names; provider exports describe what exists. The tool compares metadata and stops there.

  1. 01

    Declare

    List expected key names per environment in a reviewable TOML manifest.

  2. 02

    Export

    Produce one key name per line with a provider’s read-only metadata command.

  3. 03

    Block drift

    Get human, JSON, or GitHub output and a non-zero exit before unsafe deployment.

Local browser demo

Run the comparison here.

Only key names are accepted. Nothing leaves this tab or survives a refresh.

Ready offline
3 keys

One key name per line. Values and assignments are rejected.

4 keys

Paste a key-only export; input stays in memory.

Result / production

Unsafe to deploy

Blocked
1Missing
2Extra
1Rename?
Capacity4 / 3 · over

No changes were made. Review the likely rename, then update the source of truth or destination export.

Ship the guardrail

One binary. Zero runtime services.

Build from source today. Release artifacts are published by the Param Factory.

shell
$ cargo install --git https://github.com/B-Divyesh/sf-secret-sync-preflight
$ sspf check --manifest preflight.toml --format github
FAIL  2 destinations, 1 missing, 2 extra, 1 likely renamed