Document how the three secret backends are selected and what they guarantee:
- macOS Keychain (
security)
- Linux Secret Service (
secret-tool)
- OpenSSL AES-256-CBC + PBKDF2 vault fallback
Cover backend selection order, the doctor output, and the guarantees (no plaintext on disk, no argv exposure, no child-process env).
Document how the three secret backends are selected and what they guarantee:
security)secret-tool)Cover backend selection order, the
doctoroutput, and the guarantees (no plaintext on disk, no argv exposure, no child-process env).