Secret Champion — Settings & Secret Manager Status

Desktop CLI Bridge Connection

Loopback daemon communication settings (`http://127.0.0.1:18791`)

Bridge URL:

The DBusiness desktop companion runs on loopback port 18791.

OpenBao Secret Manager Architecture

Canonical pathing, Transit KMS envelope, and Zero Fake Data guarantees

Storage Engine OpenBao KV-v2

Encryption Transit KMS (AES-256-GCM)

Canonical Prefix secret/data/tenants/

Security Policy Fail-Closed & Zero-Knowledge

Canonical Vault Path Structure: secret/data/tenants/<tenant_id>/teams/<team_id>/<secret_key>

Plaintext secrets are never stored on disk unsealed. All mutations receive a versioned Transit envelope (vault:v1:<iv>:<tag>:<ciphertext>) managed by the host TRK ring.

Default Scopes & Preferences

Default team and tenant settings for new secrets

Default Team Space:

Default Tenant ID:

Automatically sync changes with Desktop Bridge

Data Management

Local vault cache and emergency backup export

Clearing local cache removes offline memory only. Live OpenBao secrets in ~/.businesschampion/secrets remain protected.