heyderekj / slinky

# Slinky
**Slinky keeps secrets out of files.** A small, native Mac app for the things you're told to "store somewhere safe": API keys and tokens, each project's `.env` variables, two-step backup codes and recovery keys.
The family: Dinky makes files smaller. Binky sorts your files. Slinky keeps secrets out of files.
## What it does
- **Paste anything secret.** Press ⌘N and paste. Slinky turns the value into dots right away, recognizes common services (Stripe, OpenAI, Anthropic, GitHub, Supabase, Resend, AWS and more), and suggests where it belongs.
- **Projects for `.env` files.** Drop a project folder and Slinky reads its `.env` files, sorts them into Local, Preview and Production, checks they're in `.gitignore`, and uses `.env.example` to show what's missing.
- **Recovery codes that cross themselves off.** Copy a backup code and Slinky marks it used, and tells you when you're running low.
- **Quick Access, ⌥⌘K.** Find and copy anything from any app. Copies are marked private, so clipboard history apps skip them, and they clear themselves.
- **The `slinky` command.** `slinky run -- npm run dev` starts your app with a project's variables after Touch ID, with no `.env` on disk. `slinky xcconfig` for Xcode builds, `slinky env --export` and an optional zsh hook that loads a project's variables when you `cd` into it.
- **AI agents use secrets without seeing them.** Connect Claude Code, Cursor, Codex or Claude (MCP, names only). Agents run commands through `slinky run`, you approve each one with Touch ID, and live keys stay out. A missing key opens Slinky for you to paste, not the chat.
- **Health.** Finds exact copies of your saved values in your projects, their git history, AI tools' saved conversations and shell history (on your Mac, names and places only), with one-click fixes, a commit check, low codes, missing variables and keys about to expire.
- **Apple developer files.** App Store Connect `.p8` keys, certificates and service-account JSON kept in the vault; save a notarytool profile without the `.p8` lying around; hand a file to a command as a private temp file.
- **Make a new key, send it where it runs.** "Make New Key on GitHub…" opens the right page and replaces it everywhere it's used. Send a project's variables to Vercel, Netlify, Cloudflare or Fly through their own tools.
- **Activity.** What was copied or used, when and by whom. Names only.
- **No accidental doubles.** Paste something you've already saved and Slinky tells you where it is.
- **Import what you already have.** Bring keys over from another app: a `.1pux` export from 1Password, or a CSV from Apple Passwords, Bitwarden or a spreadsheet of keys. Slinky picks out keys, tokens, backup codes and recovery keys, and leaves passwords for Apple Passwords.
- **Locks itself.** Touch ID to open. Locks with your screen, on sleep, when you're away, and after 12 hours.
- **Shortcuts.** Add to Slinky, Copy from Slinky (Touch ID every time), Open Quick Access and Lock Slinky.
## Where your