vault

Docs

Preview Vault Workflow

Back to docs

1) Create a project

  • Open /create.
  • Pick a passphrase (keep it separate from the share link).
  • Select rendered outputs (HTML/PDF/images/CSV).

2) Encrypt and upload

  • Files are encrypted locally in the browser.
  • Each encrypted file uploads via a presigned URL to MinIO.
  • A manifest describing the encrypted files is encrypted and stored.

3) Share

  • Share the project link: /p/<projectId>.
  • Share the passphrase separately.

4) View

  • Collaborators enter the passphrase.
  • Decryption happens locally in their browser.
  • Non-public projects require a signed-in project member; only public links allow anonymous access.
  • Team shared uses per-device keys with a device challenge before the server returns the encrypted project key.

5) Update

  • Re-run the upload with the same project link if you want new files.
  • The manifest is replaced with the latest file list.

GitHub sync (automatic updates)

  1. Go to /connect and connect GitHub.
  2. Select a repo and folder to sync.
  3. Generate a project ID (passphrase and sync token are stored locally).
  4. Create the workflow and sync (the app sets repo secrets automatically).

Each push to the selected folder triggers the encryption + upload step, keeping the viewer link updated. The workflow downloads preview-sync.js from /api/preview-sync, encrypts in the runner, and posts ciphertext to /api/sync.

Dashboard management

  • Sign in with GitHub, then visit /dashboard to see owned + shared projects.
  • Use /dashboard/new to create projects and rotate sync tokens.
  • Collaborators can be added via the project detail page.

Security levels

  • Choose the security level when creating a project.
  • Zero-trust does not store the passphrase anywhere.
  • Local device stores it only in the browser.
  • Team shared uses encrypted per-user keys.
  • Server managed and public link store the passphrase encrypted on the server.