# Credential vault

Model keys are pasted by the user into the settings screen. They are never stored as server environment
configuration and never appear in the DOM of a subsequent page.

`lib/vault.ts` seals with AES-256-GCM under a key derived from `APP_SECRET`, and renders secrets as bullets plus the
last four characters (`••••1234`). `open` returns null instead of throwing when `APP_SECRET` changed, so the app
asks for the key again instead of crashing.

`settingsView` is the only shape the forms ever receive, which is what makes "never echo a stored secret back"
structural rather than a per-field discipline.

Related: [[Session cookie rules]], [[Settings form]], [[SQLite schema]].