Changelog

All notable changes to varsafe.

[7.8.0 – 7.8.1] - 2026-10-18

Added

CLI 7.8.0: varsafe import .env brings an existing .env file into an environment, showing its plan first and never printing a value. Keys the environment already has are kept unless you pass --replace-existing.

Fixed

CLI 7.8.1: inside a repository, -p or -e on its own takes the rest from the repository’s .varsafe file instead of your user-level context, which could name another project. Your saved context now changes only after you choose at a prompt.

[7.7.0] - 2026-10-17

Added

CLI: varsafe export and varsafe list --reveal tell your team’s audit log whether values were exported, and in which format, or shown on screen, instead of recording a plain read.

Platform — 2026-10-17

Added

Dashboard: your profile shows your own security activity: sign-ins, refused attempts, and two-factor, passkey, session and device changes. Your team’s owners and admins see the same for their members in the team’s audit log, and only they see addresses and devices there.
API: the audit log records far more of what happens in a team: refused attempts, CLI logins and connected AI agents, secret renames and pruned versions, how members joined and the roles they held, checkouts, failed payments, seat changes, and who read the log.

Fixed

Installer: a failed install now always says why. An unreachable release server, a mistyped VARSAFE_VERSION or an unsupported platform used to end it without a message, and an x64 CPU or VM type too old for varsafe is now named as the cause.
Installer: Debian, Ubuntu and Arch machines with the musl package get the regular build instead of being refused, and RHEL 8-family machines can install once EPEL’s openssl3 is present.
Installer: re-running with a custom VARSAFE_INSTALL_DIR no longer adds another PATH line each time, and curl … | sudo bash stops with guidance instead of leaving an install your user cannot open.

Security

Installer: a pinned VARSAFE_VERSION installs exactly that release or nothing, and every release is verified before its binary is downloaded.
API: reading secret values now fails when the read cannot be recorded in the audit log, so a value is never returned without its record.
API: an API token can no longer tell whether an environment or a secret outside its reach exists; it gets the same answer as for one that does not.

[7.6.0] - 2026-10-08

Added

CLI: varsafe export creates the environment’s encryption key on first use, for anyone allowed to read the environment’s values, instead of refusing until an owner or admin had created it.

Changed

CLI: varsafe run --env-file opens an encrypted .env file through varsafe, with a varsafe login or an API token, for anyone allowed to read the environment; its private key no longer reaches your machine. Update the CLI to keep using committed .env files.

Fixed

CLI: when the API rejects a token from VARSAFE_API_TOKEN or VARSAFE_TOKEN, the error names that variable and says to check or replace the token, instead of suggesting varsafe login, which cannot help in a pipeline.
CLI: varsafe set and varsafe unset refused because your varsafe login was approved without write access now say so, and how to fix it: run varsafe login --force and choose Full access.

Security

CLI: varsafe no longer reads a .env or bunfig.toml from the directory you run it in, so a repository you cloned cannot change its settings, add variables to varsafe run, or run its own code inside the CLI. Update the CLI.

Platform — 2026-10-08

Added

Dashboard: connect GitHub, GitLab, Google or Bitbucket from Profile > Connected accounts and sign in with it from then on; connecting or disconnecting one is recorded in your audit log. A provider sign-in for an email that already has an account now says to do exactly that.

Fixed

Dashboard: single sign-on can be set up end to end from Team settings: verify your domain with a DNS record, copy the values your identity provider asks for before you save, and edit the configuration later. OIDC identity providers outside varsafe’s own domains now work.
Dashboard: opening the Secrets page no longer records an export of every other environment; its suggestions use names, and a value is read and audited only when you show or add it. Deleting selected secrets now asks first.
Dashboard: accounts in passkey-only mode can sign in with their passkeys again. Turning the mode on used to refuse every sign-in, passkeys included, which locked the account out.
Dashboard: audit log exports hold every event of a period up to 366 days, as CSV or a SOC 2, GDPR or HIPAA report, for owners and admins on Team. The log now records two-factor, passkey and password changes, and no longer shows a single sign-on or a renewed session as a password sign-in.
Dashboard: seats are counted the same way everywhere, so members whose deactivation took effect no longer count toward your limit or bill, and a reactivation can use paid seats. Billing names the team it manages, and the Overview counts every project of the active team.

Security

API: an API token for all environments can no longer change a protected environment such as production, over the API or MCP; it still reads it, and a pipeline that writes production needs a token created for production. Only owners, admins and developers can create projects.
API: encrypted .env files are opened by varsafe for anyone allowed to read the environment’s values, each opening audited with variable names only, and an environment’s private key can no longer be downloaded. Files encrypted earlier still open.

[7.5.0] - 2026-10-06

Added

CLI: mint read-only unless write is asked for

Fixed

CLI: drop the unused simple-git from the CLI (CVE-2026-102828, CVE-2026-102829)
CLI: a locked OS keychain stops a command after 30 seconds instead of hanging it
CLI: the welcome screen says what the landing says

Platform — 2026-10-06

Added

Docs: a REST API reference at https://docs.varsafe.dev/api, one page per operation with curl, JavaScript and Python samples, generated from the published OpenAPI spec. A new reference page lists every machine-readable file: the spec, llms.txt, llms-full.txt and the MCP manifest.
API: the OpenAPI spec now describes every response body and error, so generated clients get typed results. It is also served from the API itself at https://api.varsafe.dev/openapi.json.
MCP: the hosted server now tells every connecting agent how to work with your secrets: run commands through varsafe run, keep values out of .env files and the conversation, and generate keys server-side. Claude Code, Codex, Cursor and VS Code pick it up with no setup.

Changed

MCP: Claude Code, VS Code and Codex sign in under the identity their vendor publishes, and the consent screen shows who published an app, where your approval goes and your existing connections to it. A local client can sign in again from another port without registering.
API: a token limited to named environments now reaches exactly the environments that matched when it was created, across its projects, and not ones created later. Naming an environment that does not exist is refused.
API: new API tokens are read-only unless you choose “Read and change secrets” when creating them; existing tokens keep their access level. Automations that write secrets need a token created with write access.

Security

CLI: a varsafe login now lasts at most 180 days, so a copied credential cannot stay valid indefinitely. Existing logins keep working for 180 days from this release; after that, run varsafe login again.

[7.4.0] - 2026-09-25

Added

CLI: varsafe login now asks you to enter its code in your browser rather than confirm it, matching the new approval page.

Platform — 2026-09-25

Changed

Dashboard: the code field formats what you type as ABCDE-FGHJK, with or without the dash, and shows which account you are signed in to, with a sign-out link, before you enter the code.

Security

Dashboard: approving varsafe login now requires typing the code your terminal shows, and you get an email each time CLI access is approved. If you receive one you did not expect, revoke that access from your profile and change your password.

[7.3.0 – 7.3.1] - 2026-09-24

Added

CLI 7.3.0: lengthen the CLI sign-in code to 10 characters (XXXXX-XXXXX)

Changed

CLI 7.3.0: move the build-cli release job out of YAML into tested scripts

Fixed

CLI 7.3.1: stop the install gate if its scratch directory cannot be made
CLI 7.3.1: run the install gate from an exec-capable directory
CLI 7.3.0: drop the “someone else approved that code” hint after login
CLI 7.3.0: route every documentation link through a checked registry
CLI 7.3.0: make the install gate unskippable, and test the pin end to end

[7.2.32] - 2026-09-17

Fixed

CLI: run the downloaded binary before it replaces the working one
CLI: close the escalated review findings

Security

CLI: varsafe run no longer hands a Varsafe token set in your environment to the command it runs. If that command needs it to call Varsafe itself, pass --pass-credential.

[7.2.30 – 7.2.31] - 2026-09-14

Fixed

CLI 7.2.31: close defects from a fourth OpenCodeReview pass
CLI 7.2.30: close defects from a second OpenCodeReview pass
CLI 7.2.30: preserve mount semantics
CLI 7.2.30: make publisher execution and reseal tests deterministic
CLI 7.2.30: separate registry and artifact credentials
CLI 7.2.30: require an explicit publish decision

[7.2.10 – 7.2.29] - 2026-09-13

Fixed

CLI 7.2.29: close defects found by an OpenCodeReview pass
CLI 7.2.29: terminate publisher command explicitly
CLI 7.2.28: keep publisher failure handling shell-safe
CLI 7.2.27: keep Bunny purge key in protected CI
CLI 7.2.26: retain protected storage writer
CLI 7.2.25: bound build keyring verification
CLI 7.2.24: enforce a build ceiling
CLI 7.2.23: avoid ACL mutation for restricted publisher
CLI 7.2.22: skip emulated keyring daemon roundtrip
CLI 7.2.21: force-stop wedged emulated keyring checks
CLI 7.2.20: bound CDN verification requests
CLI 7.2.19: keep piped welcome independent of keyring
CLI 7.2.18: isolate cli smoke test home
CLI 7.2.17: avoid bucket administration checks
CLI 7.2.16: support write-only object publisher
CLI 7.2.15: use stateless restricted s3 uploads
CLI 7.2.14: keep publisher shell literal-safe
CLI 7.2.13: isolate publisher configuration
CLI 7.2.12: pin publisher config per upload
CLI 7.2.11: configure restricted publisher remote
CLI 7.2.10: Release recovery uploads can now complete with the scoped publisher credential.

[7.2.9] - 2026-09-12

Changed

CLI: finish the SonarQube quality sweep and undo its behavioural regressions

Fixed

CLI: repeating --include now injects every pattern you passed. It previously kept only the last flag and silently left the other secrets empty, which could write a credential file that looked correct but was not.

[7.2.8] - 2026-09-05

Fixed

CLI: keep --tmpfs writing to /dev/shm, and close the attack with the guard
CLI: give the loader-control rule its own module
CLI: stop an export writing through a symlink, and a secret hijacking the child

[7.2.7] - 2026-09-04

Changed

CLI: upgrade NestJS to 12 and validate requests with the built-in Standard Schema pipe

Fixed

CLI: stop caching node_modules, so a bad install layout cannot latch

Platform — 2026-09-04

Changed

MCP: a client that registers a http://localhost callback must now send "application_type": "native" in its registration request. Loopback callbacks are only accepted for native clients; a client that omits the field is refused at registration.

Platform — 2026-08-22

Added

API: the programmatic API surface is now published as an OpenAPI specification at https://varsafe.dev/openapi.json, with the scope each route requires. Point a client generator or an AI agent at it instead of hand-writing requests.
Docs: https://varsafe.dev/llms.txt describes what varsafe is for and when to reach for it, so agents can decide whether it fits a task without reading the marketing site.

Changed

Docs: a missing page on varsafe.dev now answers with links to the sitemap, the API specification and the documentation, in Markdown for clients that ask for it, instead of a bare “file not found”.

[7.2.6] - 2026-08-19

Changed

CLI: close the last three convention decisions

[7.2.5] - 2026-08-15

Fixed

CLI: tolerate EPIPE on stdout data pipes

[7.2.4] - 2026-08-15

Changed

CLI: finish the ruled convention remediation (wave 2)
CLI: typed errors everywhere, strict scoped writes, canonical transaction scope

Fixed

CLI: honor the disclosure policy in MCP tool errors and repair dead assertions

[7.2.3] - 2026-08-12

Fixed

CLI: keep snippet scratch out of the git checkout

Platform — 2026-08-12

Fixed

API: Emails that a provider rejects are now retried instead of being recorded as delivered. Some invitations, verification links and password resets could previously be dropped without notice.

Security

API: SSO configuration is now restricted to team owners and admins on the Team plan, where other signed-in accounts could previously create a provider. Existing SSO settings are unchanged.
API: Names shown in emails, such as a team or inviter name, are now escaped. A crafted name could previously alter the appearance of an invitation.
API: Repointing an SSO provider at a different identity provider now issues a new provider ID, so existing linked accounts cannot be inherited by the new one.

[7.2.2] - 2026-08-10

Fixed

CLI: pass the session bus through to spawned snippets

[7.2.1] - 2026-08-10

Changed

CLI: import the canonical secret-key pattern instead of redeclaring it

Platform — 2026-08-10

Added

API: Ending a session is now recorded, whichever way it happens — you revoking one of your own devices, an admin revoking a member’s, or an incident response — each with the reason it ended and what the person who did it had proved.
API: Changes to the account allowlist are now recorded, so who was granted or denied the ability to create an account is answerable from the audit log.
MCP: Connect an AI agent with an API token instead of the browser sign-in — for machines with no browser of their own, or when your agent should use a different account than your CLI. Grant a token MCP scopes on the API Tokens page, then pass it as an Authorization header.

Fixed

API: An access review is returned even if its audit entry cannot be written, instead of failing the whole request.

Security

MCP: A connected agent is now held to its owner’s current role, so lowering someone’s role takes effect on their agent immediately — previously only removal and deactivation did. An agent that starts refusing a tool needs the role that permits it restored.

Platform — 2026-08-09

Added

API: Your own account activity — sign-ins, sign-outs, passkey and two-factor changes — is now readable at GET /audit/actor/:actorId. These records were always written but no view could return them.
API: Generating a compliance export or an access review is now itself recorded in the team’s audit log, with who asked and which period it covered.

Fixed

Dashboard: The Audit Log page now opens for people who belong to no team, instead of failing with a validation error.
API: Account creation is recorded as its own event rather than as a sign-in, so signing up and signing in are no longer indistinguishable in the audit log.
API: Operator-only platform records no longer appear in a platform administrator’s personal activity, and personal activity now respects your plan’s retention window.

Platform — 2026-08-08

Added

Composed secrets — build a secret from other secrets: switch the value field to Composed and type ${ to pick a key. The dashboard shows what each secret is built from and what depends on it, and asks what to do before a delete or rename would break something.

Changed

Plan limits on team members and projects are now enforced on every path that creates one.

Fixed

Dashboard: two dialogs that could get stuck now recover — the Secrets page no longer sits on “Select team”, and the Add Passkey dialog no longer stays on “Registering…” after you dismiss the browser prompt.

Security

Every credential event is audited — issued, approved, refused, expired and automatically revoked — in each team the credential can reach.
Identity-provider URLs are validated when you save your SSO settings, and must be https.
API hardening — rate limits are counted across the whole service, secret responses are never cached, the client address can no longer be chosen by the caller, and the dashboard ships a Content-Security-Policy.
AI-agent tools validate every argument the way the API always has, and export patterns can no longer be made expensive to evaluate.

[7.2.0] - 2026-08-05

Added

CLI: read, write and delete composed secrets.

Fixed

CLI: varsafe set --stdin works when its input is a redirected file.

[7.1.3] - 2026-07-31

Fixed

CLI: varsafe status tells an inaccessible project apart from a connection problem, and re-checks which team you are in rather than trusting a stale local copy.

Platform — 2026-07-31

Fixed

The one-line installer works again — curl -fsSL https://varsafe.dev/install.sh | bash exited without installing anything. It now also checks it can write to the destination before downloading, and never hangs a CI runner.
AI agents: revoking a connection takes effect immediately, and membership or role changes retire the connections they affect.

[7.1.2] - 2026-07-30

Fixed

CLI: varsafe update offers a sudo-free reinstall to ~/.varsafe/bin when it cannot write to the install it is running from.

[7.1.1] - 2026-07-30

Fixed

CLI: varsafe update says it cannot write to its install before downloading, and gives the exact command to run.

[7.1.0] - 2026-07-28

Fixed

CLI: varsafe get -n suppresses the trailing newline.

[7.0.0] - 2026-07-28

Breaking: varsafe run and varsafe run --env-file both changed behaviour, and the API now rejects unrecognised request fields. Read the migration notes below before upgrading.

Added

CLI: Linux ARM64 support, light and dark themes (varsafe theme), and varsafe status — one screen with the credential, project and environment you are working against.
CLI: varsafe list --include filters by glob, and varsafe run --shell runs a command that genuinely needs a shell.
Dashboard & API: read-only API tokens, ideal for CI jobs and audits. An existing token can be narrowed to read-only at any time, effective immediately.

Changed

CLI: Breaking — varsafe run runs your command directly, and --env-file reads encrypted files only. Migration: write the arguments out or use --shell, and source plaintext .env files inside the child process.
API: Breaking — an unrecognised field in a request body is rejected instead of being dropped while the request still returns success. Migration: the response names the field.

Removed

CLI: shell completion. Migration: remove any eval "$(varsafe completion zsh)" from your shell config.

Security

CLI: encrypted .env values are tied to the variable they belong to, so a value moved onto another variable no longer decrypts. Re-export any .env written before this release.
API: key rotation now covers leaving and demotion, not just removal by an admin.

Thirty-six releases over nine days, during which varsafe gained AI-agent access, encrypted exports and multi-team workspaces. Rather than list every patch from that window, the changes that affect you are collected here. Individual releases before 2.0.0 continue below.

Added

AI-agent access — agents manage secrets through a standard OAuth 2.1 flow, with scoped consent and full audit coverage. Works with Claude Code, Cursor and any MCP-capable client.
Encrypted .env exports — varsafe export encrypts by default, so an exported file is safe to commit. CI can write one; reading one back stays restricted to an owner or admin.
Multi-team support — belong to several teams and switch between them from the dashboard and the CLI. The active team is remembered per project.
More ways to set a secret — varsafe set reads from stdin, a masked prompt, an environment variable or a file, so a value never appears in your shell history. varsafe get prints one.

Changed

Breaking — varsafe set no longer takes the value as an argument, which was visible in your shell history. Migration: printf %s "$VALUE" | varsafe set API_KEY --stdin.

Fixed

varsafe export writes faithful files — values containing shell characters or Windows line endings came back mangled, and multi-line secrets were silently flattened. Re-export anything written before this release.

Security

Sign-in and local storage hardened — OAuth 2.1 with PKCE, logout revoked server-side, the local encryption key in the OS keychain, and publisher-signed release manifests.
Tenant isolation is enforced at the storage layer, so teams cannot reach each other’s data even if an application check were bypassed.

[1.0.56] - 2026-03-05

Added

varsafe run --include '<patterns>' — inject only the secrets matching a glob.
varsafe login takes an API token from a masked prompt, from stdin, or from VARSAFE_TOKEN.

Fixed

API tokens authenticate CLI and API requests end to end.

[1.0.52] - 2026-02-14

Added

varsafe set and varsafe unset — create, update and remove a secret from the command line.
Checksum verification on CLI install and update.

[1.0.0] - 2026-01-21

Added

Initial release — a CLI-first secrets manager for developers and teams: login, use, ls, export, and run <command> to inject secrets into any process.
Dashboard for projects, environments, secrets, teams and API tokens.
One-line install: curl -fsSL https://varsafe.dev/install.sh | sh.