Organize secrets into projects and environments

A project is a team secrets container, addressed by a stable, immutable slug (e.g. my-app). Each project has ordered environments — by default Development, Staging, and Production. Production is born with the protected mark: a lock in the header signals "this is production" without blocking edits. A secret's identity is the triple project + environment + key.

• Values are encrypted on the server and never appear in listings — the main grid is a presence matrix.
• The project creator and Vault managers have implicit administration on every environment. Everyone else needs a per-environment grant — see Access and deploy tokens.
• A newly created project is visible only to the creator and managers until grants are issued — secure by default.
• Existing Env credentials and all current Vault flows keep working unchanged: the two models coexist on purpose.

1. 1

   Open `Projetos` (Projects) in the Vault sidebar and click `Novo projeto` (New project).

   The list shows name, slug, description, and the last update for each project you can see.

2. 2

   Give the project a `Nome` (Name).

   The identifier (slug) is derived live and shown under the field. It is used by the CLI and the API and is final after creation. A name that yields a slug already used in the team is rejected.

3. 3

   Adjust the `Ambientes iniciais` (Initial environments), if you want.

   The Development/Staging/Production chips can be removed and others added — up to 20 environments, with names of up to 40 characters. Leaving it empty creates the default trio.

4. 4

   Click `Criar projeto` (Create project).

   result

   The project opens directly on the key matrix.

The project page is a grid: rows are keys (fixed column, monospace) and columns are the environments you can read, in the order set in settings. A filled cell shows the •••••• mask and the version badge (v7); an empty cell shows — faltando (missing) — the gap is first-class information: "that key does not exist in staging".

• The Filtrar chaves… (Filter keys…) field restricts the rows.
• Protected environments show a lock in the column header.

Clicking a cell opens the KEY · Environment dialog:

• Revelar (Reveal) fetches the decrypted value — an audit line is written with your name in the project history. Only after revealing does the editor unlock: saving requires resubmitting the value with the comment, so there is no "blind" overwrite.
• Edit the Valor (Value) (multiline works) and the optional Comentário (Comment); Salvar (Save) writes a new version. Resubmitting exactly the same value and comment is an honest no-op — no version churn.
• The Histórico (History) section lists versions, newest first: Gravada (Written), Removida (Removed), Restaurada (Restored), with comment and date.
• Restaurar (Restore) on an older version rolls back — it appends a new version, never rewrites the past.
• Remover deste ambiente (Remove from this environment) deletes the key in that environment. History survives; recreating the key continues numbering from where it left off.
• On a — faltando (missing) cell, the same dialog opens already in create mode, to fill the gap.

Nova chave (New key) creates a key with the same value in every checked environment at once. Key names follow the environment-variable pattern: letter or underscore first, then letters, numbers, and underscore.

Each environment's ⋯ offers:

• Renomear (Rename) — the slug does not change, so scripts and tokens keep working.
• Proteger/Desproteger (Protect/Unprotect) — toggles the protected-environment mark.
• Mover para a esquerda/Mover para a direita (Move left/Move right) — reorders the matrix columns.
• Exportar variáveis (Export variables) — downloads the whole environment; see Import and export variables.
• Gerenciar acesso (Manage access) — shortcut to settings already on the right environment.
• Excluir ambiente (Delete environment) — refused on the project's last environment and destructive on the others: keys, history, and tokens bound to that environment are revoked in cascade.

Env credentials gain the Promover para projeto (Promote to project) action: the credential's keys become a new project with the default environment trio, and the values land in the environment you choose — Development by default; only Development, Staging, and Production are accepted, and the other two are born empty.