v1.4.3

Security release

This release fixes a high-severity command injection in vaultic ci export (GHSA-5cfx-fmm5-7p2f). Secret values could run shell commands when the output was passed to eval. It also writes private keys and decrypted files with owner-only permissions, and the audit log no longer stores a hash of plaintext secrets.

If you use 1.4.0 – 1.4.2, upgrade now: vaultic update or cargo install vaultic --force.

See the CHANGELOG for all changes.

Write-up (ES/EN): A secret that ran code: post-mortem of a vulnerability in my own secrets manager

What's Changed

• fix: security hardening for v1.4.3 by @SoftDryzz in #7
• chore: 1.4.3 follow-ups (test isolation, CI, review fixes) by @SoftDryzz in #8

Full Changelog: v1.4.2...v1.4.3