Permissions

# Permissions and revocation

Cloud/API permission list: []
GitHub OAuth/App permission list: []
Mail scopes: []
AWS IAM policy: {"Version":"2012-10-17","Statement":[]}

Env Vault makes no cloud calls and stores no API tokens. There is no token row and no
revoke-token button because this module has no token submission path. This is an explicit
no-custody exception to the family credential-store requirement; adding a dummy token
store would increase risk. No Fernet key is required by this free module.

Local access: read the chosen .env, identity and ciphertext; write only explicit outputs,
.envvault.json and the requested Git pre-commit hook. The hook reads the Git index.

To revoke a recipient: rotate every ciphertext with --recipient listing only retained
keys, remove the identity from the CI secret store, and rotate credentials at their
providers. Old ciphertext remains decryptable. No hosted revocation can erase that.

CI: repository contents read; a job-specific age private identity from your own secret
store. Limit the key to one environment; never expose it to fork pull requests.
Coolify: use the existing fleet setter only in the authorized deploy terminal. Its write
permission is intentionally outside this read-only local module. No Coolify token enters
the web app or the evidence report.