# Stashbase

> Keep development moving without losing control of secrets.

Stashbase is a secrets and environment-access platform for software teams that work with both people and AI agents. It replaces scattered .env files, ad-hoc access requests, and risky prompt context with a shared, reviewable control plane.

## TL;DR

- Developers get the environment they need without waiting for someone to send a secret.
- Coding agents can make useful API calls without receiving the underlying credentials.
- Platform and security teams retain boundaries, approval paths, and auditability as access expands.
- Exposed values can be detected, replaced, and rotated before they become an incident.

## The problem Stashbase solves

Credentials tend to spread wherever work happens: local .env files, source code, chat threads, tickets, CI settings, and AI prompts. This creates two kinds of friction at once:

1. Teams move slowly because the right environment or access path is hard to find.
2. Teams take on more risk because credentials are copied into places where they are difficult to control, revoke, or audit.

Stashbase makes access part of the workflow instead of a side channel.

## Outcomes for developers

- **Start work with the right environment.** Pull the credentials and configuration a service actually needs without asking around or passing .env files between people.
- **Reduce setup drift.** Model environments around the way a team actually works, then select only the secrets required for a task.
- **Keep momentum through operational questions.** Make it easier to find the context behind an environment, draft a change, and review it before anything goes live.

## Outcomes for teams using AI agents

- **Let agents help without handing over the keys.** Give coding agents a narrow, reviewable path to the services they need while keeping secret values out of their context.
- **Keep secrets separate from egress.** Let an agent use registries and documentation without allowing credentials to reach those destinations.
- **Make agent behavior accountable.** Keep trusted profiles with the project and review metadata-only records of allowed and denied credential exchanges.

## Outcomes for security and platform teams

- **Set boundaries that do not block delivery.** Scope access by environment, secret, host, and workflow instead of relying on shared long-lived credentials.
- **Respond before a leak becomes an incident.** Detect hardcoded values early, replace them with managed secrets, and rotate compromised credentials with confidence.
- **Keep work observable.** Retain a central view of access and secret activity while developers and agents keep moving.

## How Stashbase works

- Store and organize secrets by project and environment.
- Give people and automated systems explicit, scoped access paths.
- Deliver only the values or placeholders needed for a task.
- Detect exposed credentials in code and workflows before they spread.
- Audit secret activity and access decisions from a central place.

## How agents work safely

- Agents use short-lived placeholders instead of receiving underlying secret values in their environment or context window.
- A secret can be exchanged only with API destinations the team has approved.
- Trusted agent profiles can live alongside the code they support in `stashbase-agent.toml`.
- The proxy can run locally for private development or remotely for additional isolation.
- Operators can review metadata-only logs for both allowed and denied credential exchanges.

## Common workflows

### Unblock local development

1. A developer selects a project and the environment they need.
2. Stashbase provides the selected configuration and secrets through the CLI.
3. The application starts with the right values, without a team member sharing a .env file.

### Give an agent controlled API access

1. A team defines an agent profile and approved destinations.
2. The agent requests access while completing a task.
3. Stashbase brokers the approved exchange without revealing the underlying credential to the agent.
4. The activity remains reviewable.

### Respond to a secret exposure

1. Stashbase detects a hardcoded credential in code or a workflow.
2. The team replaces the exposed value with a managed secret.
3. The compromised credential is rotated before it can continue to spread.

## Who Stashbase is for

- **Developers** who need a faster, safer path into the right environment.
- **Engineering and platform teams** that need to support many projects and environments without access chaos.
- **Security teams** that need to reduce secret sprawl without creating friction for delivery.
- **Teams adopting coding agents** that need useful automation without placing credentials in prompts or context windows.

## Site index

- [Human landing page](https://stashbase.dev/): Product overview for people.
- [Machine-readable overview](https://stashbase.dev/home-machine-version): This page.
- [Pricing](https://stashbase.dev/pricing): Plans and product access.
- [Security](https://stashbase.dev/security): Security approach and controls.
- [Philosophy](https://stashbase.dev/philosophy): How Stashbase thinks about software, access, and agents.
- [Terms](https://stashbase.dev/terms): Terms of service.
- [Privacy](https://stashbase.dev/privacy): Privacy policy.

## Useful links

- Product documentation: https://docs.stashbase.dev/platform
- Agent documentation: https://docs.stashbase.dev/agents
- Secret detection: https://docs.stashbase.dev/platform/scans/basics
- Get started: https://app.stashbase.dev/signup