Jitpass releases local-first tool to secure Mac secrets behind Touch ID
Developers can now shield sensitive tokens from malicious scripts and AI agents using a two-gate security model on Apple Silicon.
Jitpass has launched 'jit', a free, local-first application designed to secure plaintext secrets on macOS systems running Apple Silicon. The tool identifies credentials stored in common configuration files, such as .env files, AWS credentials, and shell exports, and moves them into a local encrypted vault protected by Touch ID. This release addresses growing concerns regarding the exposure of sensitive data in development environments to malicious scripts and AI agents operating with user permissions.
The application employs a two-gate security model to manage access. The first gate unlocks the encrypted vault via biometric approval, while the second gate requires per-process consent before handing credentials to specific applications. This ensures that even if the vault is unlocked, a sketchy npm install or an unauthorised script cannot access the keys without explicit user approval.
To maintain compatibility with existing workflows, jit rewrites configuration files to include decoys rather than removing credentials entirely. When a legitimate tool requires access, the real value is injected into memory only for that specific process. On disk, the original file remains but contains a decoy, ensuring that secrets are not exposed to other processes or agents running on the machine.
Users can establish process grants that allow named terminal sessions to access secrets for up to eight hours without further prompts. This feature is designed for scenarios involving long builds or scheduled jobs where screen locks might otherwise stall execution. The grant is tied to the specific terminal session and does not inherit to other processes, ensuring that access is strictly controlled.
The software includes an audit trail that logs command executions and access attempts, masking secret values but recording the context of access. This allows users to review exactly which tools accessed which credentials and when. The application is available via Homebrew or as a signed tarball, with source installation options for Intel Macs. It is licensed under the PolyForm Perimeter License 1.0.0, restricting use to personal and internal company purposes.
