BYOK
You Probably Don't Need Vault: How Deleting a Cache Made Our Key Storage More Secure
pCraft is a BYOK 'Postman for LLMs' whose database is full of other people's provider API keys, bearer credentials with a credit card behind them. This article walks through the envelope-encryption scheme that keeps a stolen database backup worthless, then tells the counterintuitive story of replacing HashiCorp Vault with a local key-encryption key: a change that deleted a plaintext-DEK cache a security review had flagged as critical and collapsed the key's in-memory lifetime from sixty seconds to microseconds. It covers AEAD binding contexts that defeat cross-tenant splicing, self-describing ciphertext, KEK rotation without re-encrypting rows, and how to tell when a managed secrets service is actually worth its operational cost.
Introducing pCraft: A Workbench for People Who Build With LLMs
For a year my most important work, the prompts, lived in Python strings, scattered notes, and 1am messages to myself, with no version history and no way to fairly compare one model against another. pCraft is my answer: a workbench for building with language models, 'Postman for LLMs', where you bring your own key, wire up multi-step chains, and run the same prompt across several models side by side. This founder-tone launch post covers why I built it, why I think it's useful, and the unglamorous lessons the project taught me: overbuilding infrastructure for a scale that didn't exist, falling in love with an architecture instead of a product, and what it means to hold someone else's API key.