Stop random programs from reading your Git and AWS credentials on Windows
The problem
When you use Git or the AWS CLI, your tokens and keys often sit in plain files, or in places any program running as you can read. You may not notice if one does.
What I built
Wardkey is a small, experimental tool for Windows. It keeps your Git and AWS credentials in an encrypted vault. When Git or AWS asks for a key, Wardkey checks which program is asking and applies your rules before giving anything out.
Think of it like a doorman. Many tools lock the door but give the key to anyone already inside. Wardkey checks every time: “Which program are you, and do your rules allow you to have this key?”
What it does
- Stores credentials in an encrypted vault.
- Designed to work with Git over HTTPS (as a credential helper) and the AWS CLI (through
credential_process). - Applies rules about which app may get which credential.
- Can ask you for a Windows Hello check (face, fingerprint or PIN) on each request, when your rule says so.
- Supports decoy keys. If anything asks for one, the request is denied and logged.
- Writes decisions to a local log that can detect many kinds of edits.
It’s written in Go.
Honest limits
This is an early prototype, and I’d rather say so clearly:
- It does not stop malware that is already running as you. A program running as you could try to pretend to be Git or AWS. Requiring Windows Hello on every request makes silent use harder, because you see a prompt, but it is not a guarantee.
- No outside expert has reviewed it yet.
- It’s Windows-only.
- AWS support covers only the official
aws.exe, and Git support covers only HTTPS. - The activity log can detect many edits, but not someone deleting its last entries.
- Please test with dummy credentials only.
The full list is in the threat model in the repo.
Try it
go build -o wardkey.exe .\cmd\wardkey
wardkey help
Setup details are in the README.
The code is source-available.
I’d love your feedback
Where do you think the design is weak, especially the caller checks and the approval flow? What would you want it to protect next? Tell me in the comments or via email.