Shared vault

Org-wide secrets that are not tied to a project — CI tokens, registry credentials, shared API keys. All members read; admins write.

Read the vault

bash

foostash vault list
foostash vault list --values
foostash vault get GHCR_TOKEN

Write (admin-only)

bash

foostash vault set GHCR_TOKEN=ghp_xxx SENTRY_DSN=https://…

# hidden input instead of shell history
foostash vault set GHCR_TOKEN --secret

foostash vault delete SENTRY_DSN

History and rollback

bash

foostash vault history GHCR_TOKEN
#   Version   Value                           Set At
#   ──────────────────────────────────────────────────
#   2         ghp_live_…                      2026-07-10 14:02:11
#   1         ghp_old_…                       2026-06-02 09:18:44

foostash vault rollback GHCR_TOKEN --version 1

Encryption. Same as project secrets — values are encrypted locally with your master key before upload.
Keys. Every vault command accepts --ssh-key to point at a private key other than ~/.ssh/id_ed25519.