You hold someone else's infrastructure keys
VM Ops Manager is a local, agentless operations tool. Credentials stay on your computer, protected by a two-layer vault.
No server
No account, cloud sync, or telemetry.
No agent
Monitoring uses one read-only SSH probe.
No automatic key reads
Private keys are supplied deliberately, never scanned from ~/.ssh.
Vault internals
Password-derived key
Argon2id derives a KEK from the master password. Salt and parameters travel with the vault.
Data encryption key
A separate random DEK encrypts credentials and is wrapped by the KEK.
Authenticated encryption
AES-256-GCM uses a fresh nonce and detects tampering.
Key rotation
Changing the master password rotates the DEK and re-encrypts credentials in one transaction.
OS keychain
Only the DEK may be cached in the platform keychain for automatic unlock.
Plaintext lifetime
Secrets are zeroized after connection setup whenever the platform permits.
What this does not protect against
- A compromised computer can access an unlocked vault.
- Screen lock hides the window but does not lock the vault or stop monitoring.
- A forgotten master password cannot be recovered.
- This is a single-user tool with no shared access control or independent security audit yet.