Open source without a gate.
Expert help with a written scope.

Phantom adds a local Rust HTTP proxy bound to 127.0.0.1. Request bodies are collected under byte and time limits; response streams remain bounded and incremental. Measure overhead in your own workload before adopting it on a latency-critical path.

Installation alone changes nothing. After successful initialization, your .env file contains phm_xxxxxxxx tokens instead of real values. In the managed workflow, supported clients read those placeholders rather than provider values from the rewritten dotenv file. phantom exec gives the child fresh placeholders and a separate proxy bearer. On an exact supported route, the proxy injects only that route's vault value into its fixed auth header; client headers and bodies never resolve placeholders. Other files and unmanaged processes remain outside that boundary. Human plaintext reveal is a separate trusted-terminal action with no noninteractive bypass.

A managed .env placeholder persists until you rotate it; it is not the provider credential and is not sufficient by itself to use the authenticated local proxy. phantom exec separately creates fresh session phm_ values and a fresh PHANTOM_PROXY_TOKEN for the child process. Treat a leaked placeholder as sensitive metadata and run phantom rotate.

macOS uses Keychain Services and Windows uses Credential Manager. Current Linux desktop builds use the kernel keyring, which does not provide reboot persistence; Linux users who need durable storage should select the encrypted-file vault with a protected persistent passphrase. The file backend uses ChaCha20-Poly1305 with Argon2id key derivation. Vault retrieval uses Zeroizing<String> buffers that zero those allocations on Drop. This is defense in depth, not a guarantee that every plaintext copy is erased from process or OS memory. Phantom's managed init path writes the vault before atomically replacing dotenv values and does not create a plaintext project-local backup. Existing backups, logs, and unmanaged tools are outside that boundary.

The proxy discards client control of the matched route's auth header and injects only that route's vault value there; client headers and bodies never resolve placeholders. It redacts recognized credential formats in responses. This reduces accidental exposure; it is not a substitute for provider scoping, rotation, or OS user-presence controls. Proxy session tokens use constant-time comparison.

Client headers and bodies never resolve phm_ placeholders. Bodies are collected under explicit byte/time limits and forwarded byte-for-byte. Only an exact matched route can inject its own vault value into its fixed authentication header.

The repository includes Pro-gated team-vault source with envelope encryption for fixed-membership pilots. Each member has their own keypair; the vault is encrypted to every member's public key, and the service path accepts ciphertext. Hosted availability still requires a commissioned Phantom Cloud deployment. Member removal and automatic vault-key rotation are not shipped, so do not treat this as an offboarding control.

Phantom intentionally does not leave a plaintext .envbackup during init. Keep an independent provider recovery path before migrating. phantom unwrap only reverses package-script wrapping; it does not restore dotenv values. To leave, recover or rotate credentials through the provider, update your dotenv file in a trusted terminal, then remove Phantom configuration.