ManUp v0.4.0

🚀 What's New in v0.4.0

ManUp v0.4.0 is a major feature release introducing a completely redesigned Project Workspace interface, Project-Scoped API Keys, direct name-based secret querying, native
Light/Dark theme support, and an upgraded official CLI (manup-cli v0.3.0).

---

🖥️ Redesigned Projects Dashboard & Workspace UI

• Projects Dashboard: Replaced the flat secrets listing with an intuitive project overview showcasing real-time environment status cards, member counts, and quick-action
  modals.

  • Tabbed Project Workspace: Seamlessly navigate between environments (Development, Staging, Production) within a dedicated project workspace.
  • Auto-Wrapping & Auto-Resizing Secret Editor: Multi-line values, certificates, and RSA/SSH private keys now expand and wrap cleanly without overflow.
  • Bulk .env Import & Export: Import existing .env files with automatic key-value parsing or bulk insert multiple secrets at once.

  ---

  🔑 Project-Scoped API Keys & Granular RBAC

  • Project Isolation: API keys can now be scoped to an individual project or provisioned organization-wide, enforcing zero-trust boundaries across microservices and CI/CD
    jobs.
  • Fine-Grained Scopes: Choose between full (read/write) or read-only access tokens to prevent mutating actions in deployment environments.
  • Intelligent Scoping: Scoped API keys automatically infer their target project on API requests without requiring explicit project identifiers.

  ---

  📡 Direct Name-Based Query API

  • Human-Friendly Environment Queries: Retrieve decrypted secrets using environment names, IDs, or common abbreviations:
    • GET /api/secrets?env=production
    • GET /api/secrets?env=dev&project=backend-api&format=dotenv
  • Multi-Format Responses: Native support for JSON (format=json), raw .env text (format=dotenv), and key-value maps (format=kv).
  • Bulk Secret Operations: Added POST /api/secrets/bulk for batch secret insertions and updates.
  • Resolution Headers: Responses include resolved metadata headers (X-Environment-Id, X-Environment-Name, X-Project-Id, X-Project-Name).

  ---

  🌓 Native Light & Dark Theme Support

  • Built-in Theme Switcher: Full support for Dark Mode, Light Mode, and System Preference detection.
  • Polished Contrast: Redesigned color palettes, warning banners, error callouts, and empty states optimized for high legibility in light mode.

  ---

  💻 Official CLI (manup-cli v0.3.0)

  • Name & Abbreviation Targeting: Run commands and fetch secrets using environment names without needing UUIDs:

    manup run -e dev -- npm start
    manup run -p backend -e prod -- npm test
    

  • API Key Management via CLI: Provision and revoke project-scoped access tokens:
  manup keys ls
  manup keys create ci-token --scope full --project backend --days 90

  • Scriptable Workspace Linking: Automate linking in CI/CD or Dockerfiles:
  manup init -p backend -e dev

  • Enhanced whoami: Displays active API key permissions and project isolation status.
  ──────

  🛠️ CI/CD & Deployment Fixes

  • Release-Only Deployments: Docker image builds now trigger strictly when version tags (v*) are pushed or via manual dispatch—routine pushes and PR merges to main no longer
  deploy images.
  • Cleaned Registry Tags: Removed :main and :sha-... tags; images are now published exclusively with semantic version tags.
  ──────

  🐳 Docker Images

  Docker Hub

  docker pull procoder588/manup:0.4.0
  docker pull procoder588/manup:latest

  GitHub Container Registry (GHCR)

  docker pull ghcr.io/amanbig/manup:0.4.0
  docker pull ghcr.io/amanbig/manup:latest

What's Changed

• Manup Version update 0.4.0 by @Amanbig in #2

Full Changelog: v0.3.1...v0.4.0

ManUp v0.3.1

🚀 What's New in v0.3.1

💻 Official CLI Integration & Docs

• Documentation: Integrated official documentation for manup-cli (v0.2.0), covering global installation, direct credentials login, workspace linking (manup init), and zero-disk process secret injection (manup run).
• Web Documentation Site: Built a mobile-responsive HTML documentation website in docs/index.html featuring live search, interactive quickstart guides, and high-resolution platform screenshots.

🔐 Server Authentication & Token Refresh Enhancements

• Multi-Client Token Refresh: Enhanced POST /api/users/refresh and POST /api/users/login endpoints to return and accept refreshToken in JSON payloads and headers, enabling CLI and API clients to perform automatic session token refresh.

---

🐳 Docker Images

docker pull procoder588/manup:0.3.1
# or
docker pull ghcr.io/amanbig/manup:0.3.1


**Full Changelog**: https://github.com/Amanbig/ManUp/compare/v0.3.0...v0.3.1

ManUp v0.3.0

🔒 Security & permissions hardening

• Scoped API keys — keys can now be created with full or read-only scope. A read-only key is rejected on any non-GET request, even if the underlying user could otherwise write — good for monitoring/export jobs that should never be able to mutate secrets. See the API Keys wiki page.
• Brute-force protection on auth — /register (5/min) and /login (10/min) are now IP-rate-limited, independent of API key rate limits.
• Password confirmation required to change your own email/username, or to delete your own account.
• Organization owner can no longer delete their own account — prevents an org from accidentally ending up ownerless. Delete the organization instead if that's really the intent.
• Tighter organization/member management guards: only owner/admin can update org details or remove members; only owner can delete the organization; the org owner can't be removed via member management; you can't remove yourself through that endpoint.

See RBAC and Permissions on the wiki for the full breakdown.

Other changes

• Client UI refactor — Sidebar and modal/view components split out of the main app file for maintainability.
• Various formatting/config cleanup.

Docker images

docker pull procoder588/manup:0.3.0
# or
docker pull ghcr.io/amanbig/manup:0.3.0

---

What's Changed

• Feat/security enhancements by @Amanbig in #1

New Contributors

• @Amanbig made their first contribution in #1

Full Changelog: v0.2.0...v0.3.0

ManUp v0.2.0

Docker images

docker pull procoder588/manup:0.2.0
# or
docker pull ghcr.io/amanbig/manup:0.2.0

---

Full Changelog: v0.1.1...v0.2.0

ManUp v0.1.1

🎉 First release

ManUp is a self-hosted, open-source secrets manager — a lightweight alternative to Infisical / HashiCorp Vault.

Highlights

• Centralized secrets vault with encrypted storage
• RBAC — Owner / Admin / Viewer roles, scoped to projects and environments
• Project & environment isolation (Development / Staging / Production)
• Programmatic API keys for CI/CD, with expiration and rate limiting
• Cookie-based auth with refresh tokens and httpOnly secure cookies
• Self-hosting via Docker / Docker Compose — embedded PGlite or external Postgres
• React 19 + TailwindCSS v4 dashboard

Getting started

See the Quick Start in the README.

Docker images

docker pull procoder588/manup:0.1.1
# or
docker pull ghcr.io/amanbig/manup:0.1.1

---

Full Changelog: https://github.com/Amanbig/ManUp/commits/v0.1.1