{ "slug": "safe/quickstart", "title": "Safe Quickstart", "description": "Create a local Cuitty Safe, replace env values with references, and resolve them at runtime.", "url": "https://cuitty.com/docs/safe/quickstart", "markdown_url": "https://cuitty.com/docs/safe/quickstart.md", "json_url": "https://cuitty.com/docs/safe/quickstart.json", "frontmatter": { "title": "Safe Quickstart", "description": "Create a local Cuitty Safe, replace env values with references, and resolve them at runtime.", "order": 1, "section": "Safe", "updatedAt": "2026-06-09" }, "headings": [ { "depth": 1, "slug": "safe-quickstart", "text": "Safe Quickstart" }, { "depth": 2, "slug": "install", "text": "Install" }, { "depth": 2, "slug": "create-a-local-safe", "text": "Create a local Safe" }, { "depth": 2, "slug": "replace-env-values-with-references", "text": "Replace env values with references" }, { "depth": 2, "slug": "run-with-resolved-env", "text": "Run with resolved env" }, { "depth": 2, "slug": "use-package-scripts", "text": "Use package scripts" }, { "depth": 2, "slug": "next-steps", "text": "Next steps" } ], "body_markdown": "# Safe Quickstart\n\nCuitty Safe lets you commit references such as `cuitty-safe:acme/dev/database-url` instead of raw secret values. The resolver injects the real value only at the runtime boundary.\n\n## Install\n\nRepository contributors should route package changes through Socket Firewall and pin exact versions.\n\n```bash\nsfw bun add @cuitty/safe@0.1.0\n```\n\nThe CLI binary target is `cuitty-safe`. Some Cuitty installs may also expose it as `cui safe`.\n\n## Create a local Safe\n\nLocal vault mode is the default first-run mode.\n\n```bash\ncuitty-safe init\ncuitty-safe safe create acme/dev --provider local\ncuitty-safe put acme/dev/database-url --value \"$DATABASE_URL\"\ncuitty-safe put acme/ci/github-token --value \"$GITHUB_TOKEN\"\n```\n\nThe values above come from your current shell. Do not paste real values into committed docs, scripts, or examples.\n\n## Replace env values with references\n\n```dotenv\nDATABASE_URL=cuitty-safe:acme/dev/database-url\nGITHUB_TOKEN=cuitty-safe:acme/ci/github-token\n```\n\nBare paths are valid only when Cuitty Safe is the active resolver:\n\n```dotenv\nDATABASE_URL=acme/dev/database-url\n```\n\n## Run with resolved env\n\n```bash\ncuitty-safe run --env-file .env -- bun run dev\n```\n\n`run` resolves references, injects values into the child process environment, and keeps terminal output masked by default.\n\n## Use package scripts\n\n```jsonc\n{\n \"scripts\": {\n \"dev\": \"cuitty-safe run --env-file .env -- vite\",\n \"deploy\": \"cuitty-safe run --scope acme/prod -- bun run deploy:raw\"\n },\n \"cuittySafe\": {\n \"env\": {\n \"DATABASE_URL\": \"acme/dev/database-url\",\n \"GITHUB_TOKEN\": \"acme/ci/github-token\"\n }\n }\n}\n```\n\nPrefer `cuitty-safe run` over shell command substitution. Substitution can leak sensitive values into shell history, process listings, or logs.\n\n## Next steps\n\n- [Reference syntax](/docs/safe/references)\n- [Storage modes](/docs/safe/storage-modes)\n- [CI/CD](/docs/safe/ci-cd)\n- [Security model](/docs/safe/security)", "body_html": "

Safe Quickstart

\n

Cuitty Safe lets you commit references such as cuitty-safe:acme/dev/database-url instead of raw secret values. The resolver injects the real value only at the runtime boundary.

\n

Install

\n

Repository contributors should route package changes through Socket Firewall and pin exact versions.

\n
sfw bun add @cuitty/safe@0.1.0
\n

The CLI binary target is cuitty-safe. Some Cuitty installs may also expose it as cui safe.

\n

Create a local Safe

\n

Local vault mode is the default first-run mode.

\n
cuitty-safe init\ncuitty-safe safe create acme/dev --provider local\ncuitty-safe put acme/dev/database-url --value \"$DATABASE_URL\"\ncuitty-safe put acme/ci/github-token --value \"$GITHUB_TOKEN\"
\n

The values above come from your current shell. Do not paste real values into committed docs, scripts, or examples.

\n

Replace env values with references

\n
DATABASE_URL=cuitty-safe:acme/dev/database-url\nGITHUB_TOKEN=cuitty-safe:acme/ci/github-token
\n

Bare paths are valid only when Cuitty Safe is the active resolver:

\n
DATABASE_URL=acme/dev/database-url
\n

Run with resolved env

\n
cuitty-safe run --env-file .env -- bun run dev
\n

run resolves references, injects values into the child process environment, and keeps terminal output masked by default.

\n

Use package scripts

\n
{\n  \"scripts\": {\n    \"dev\": \"cuitty-safe run --env-file .env -- vite\",\n    \"deploy\": \"cuitty-safe run --scope acme/prod -- bun run deploy:raw\"\n  },\n  \"cuittySafe\": {\n    \"env\": {\n      \"DATABASE_URL\": \"acme/dev/database-url\",\n      \"GITHUB_TOKEN\": \"acme/ci/github-token\"\n    }\n  }\n}
\n

Prefer cuitty-safe run over shell command substitution. Substitution can leak sensitive values into shell history, process listings, or logs.

\n

Next steps

\n", "links_out": [ "/docs/safe/references", "/docs/safe/storage-modes", "/docs/safe/ci-cd", "/docs/safe/security" ] }