ownlock

ownlock

Secrets for the process — not for the prompt.

ownlock run injects vault values into sandbox children. Shield and guard keep plaintext .env off agent tools and redact leaks. No Docker. No cloud account.

Install GitHub

Two problems, one broker

Sandboxes don’t inherit your shell exports — so agents can’t run real commands unless secrets somehow reach the child process. But if those secrets sit in a plaintext .env, tools can read the file straight into chat context. ownlock encrypts values at rest, injects them only into the process you run, and hardens the repo against scrapes.

How it helps

01 — shield

Harden the repo in one command

Writes ignore files, Claude deny rules, and a PreToolUse hook that blocks .env / .ownlock reads.

$ ownlock shield --verify
Shield verified — agent secret reads blocked.

02 — run

Inject secrets where sandboxes actually see them

ownlock run resolves the vault from disk and injects env into that one child — the layer your app reads from.

$ ownlock run -- python app.py
# secrets in child env; passphrase never inherited

03 — guard

Redact leaks on the way out

Stdout redaction and an optional PostToolUse hook turn accidental log dumps into [REDACTED:NAME].

$ ownlock guard --install-hook
Installed PostToolUse guard hook.

Install

Pick one. Works on macOS, Linux, and Windows.

uv uv tool install ownlock
pipx pipx install ownlock
curl curl -fsSL https://raw.githubusercontent.com/thebscolaro/ownlock/main/scripts/install.sh | bash 
$ ownlock init
$ ownlock shield
$ ownlock run -- your-command

Built to stay local