sup3rS3cretMes5age

sup3rS3cretMes5age is an open-source, self-hosted application that provides a service for sharing self-destructing messages. It uses HashiCorp Vault as a backend to store temporary secrets, ensuring that sensitive information is automatically deleted after it is read once. This prevents sensitive data from persisting on a server after the intended recipient has accessed the information.

The software is deployed as a web application and can be run via Docker, Docker Compose, or as a local Go binary. It includes a web interface for users to create and retrieve secrets, as well as a REST API for programmatic access. For users who prefer the terminal, it provides shell functions for integration with Bash, Zsh, and Fish, allowing secrets to be uploaded directly from the command line.

Key features

• Automatic deletion of messages after the first read
• Configurable time-to-live settings from 48 hours up to 7 days
• File upload support for attachments up to 50MB using base64 encoding
• Integration with HashiCorp Vault cubbyhole for secret storage
• Use of one-time tokens for creation and retrieval
• Built-in rate limiting restricted to 10 requests per second
• Automatic TLS certificate generation via Let Encrypt
• Self-hosted assets with no external CDN or tracking dependencies

The application is written in Go and utilizes a lightweight vanilla JavaScript frontend that avoids heavy libraries like jQuery to maintain a small footprint. For deployment, it provides multi-platform Docker images for amd64 and arm64 architectures, along with a Helm chart for Kubernetes environments. The architecture relies on Vault tokens with exactly two uses: one for the creation of the secret and one for its retrieval. This ensures that any second attempt to access the same token will fail.

This tool is positioned as a security-focused utility for temporary, encrypted communication and the sharing of sensitive credentials.