Secretive: The Revolutionary SSH Key Guardian for Mac

Your SSH private key is sitting on your disk right now. Unprotected. Exposed. One clever piece of malware or a single moment of physical access—that's all it takes for an attacker to copy your digital identity and gain silent, persistent access to your servers, code repositories, and cloud infrastructure. The traditional file-based SSH key model is a ticking time bomb in modern threat landscapes. But what if your private keys could be locked inside a hardware vault that even root-level malware couldn't extract? Enter Secretive, the macOS application that transforms your Mac's Secure Enclave into an impenetrable fortress for SSH keys. No more plaintext keys on disk. No more sleepless nights wondering if your credentials have been exfiltrated. Just cryptographic certainty backed by Apple's most advanced security hardware. This deep dive reveals why developers, DevOps engineers, and security-conscious professionals are abandoning conventional SSH workflows for this game-changing approach. You'll discover installation secrets, real code examples, advanced configurations, and why Secretive represents the future of developer authentication.

What is Secretive?

Secretive is a native macOS application engineered to store and manage SSH cryptographic keys within the Secure Enclave, Apple's dedicated hardware security module built into modern Macs. Created by Max Goedjen, this open-source tool addresses a fundamental vulnerability in traditional SSH workflows: the exposure of private keys as readable files on filesystems. The Secure Enclave is a isolated coprocessor that performs cryptographic operations without ever exposing raw key material to the main CPU, kernel, or any software running on the system. This means your private keys become physically non-exportable—malware, compromised applications, or even sophisticated attackers with root access cannot extract them.

The project has gained significant traction in the developer security community because it solves a problem that has plagued SSH authentication since its inception. While solutions like hardware security keys (YubiKeys) and smart cards exist, they introduce friction and require additional physical devices. Secretive leverages hardware you already own—your Mac's T2 chip or Apple Silicon processor—to deliver military-grade key protection with the seamless user experience Apple users expect. The repository, hosted at maxgoedjen/secretive, features a fully auditable build process using GitHub Actions with artifact attestation, ensuring every release can be cryptographically verified. This transparency has made it particularly attractive to enterprise users and security auditors who demand supply chain integrity.

Key Features That Transform SSH Security

Hardware-Level Key Isolation

The Secure Enclave operates as a separate security domain with its own boot ROM, secure boot process, and encrypted memory. When Secretive generates an SSH key, the private component never leaves this enclave. The main system only receives a reference handle. This architectural separation means that even if macOS is completely compromised, your keys remain protected. The enclave resists physical tampering, cold boot attacks, and memory scraping—threats that traditional file-based keys cannot withstand.

Biometric Gatekeeping with Touch ID & Apple Watch

Secretive integrates deeply with macOS's LocalAuthentication framework. Each key access attempt triggers a biometric challenge requiring Touch ID fingerprint verification or Apple Watch authentication. You can configure per-key policies—some keys might require authentication every time they're used, while others can have a timeout window. This transforms authentication from something you have (a file) into something you are (biometric identity). The authentication prompt appears natively in macOS, providing a familiar, trustworthy interface that users recognize.

Real-Time Security Notifications

The moment any process attempts to use your SSH key, Secretive pushes a notification to your Mac's Notification Center. This serves as an immediate intrusion detection system. If you're sitting at a coffee shop and suddenly see an SSH authentication prompt you didn't initiate, you know something is wrong. These notifications include the requesting application's name, providing visibility into which tools are accessing your credentials—Git, SSH, Docker, or potentially malicious software.

Smart Card Fallback Support

For Macs lacking a Secure Enclave (pre-2016 models), Secretive gracefully falls back to Smart Card support. This enables integration with YubiKeys, PIV cards, and other PKCS#11 compatible hardware tokens. The same SSH configuration works transparently whether you're using the Secure Enclave or a physical token, making it ideal for heterogeneous environments where developers use different hardware generations.

Cryptographically Auditable Builds

Starting with version 3.0, Secretive implements GitHub Artifact Attestation. Every release build is cryptographically signed by GitHub's infrastructure, creating a verifiable chain of custody from source code to compiled binary. Security teams can independently verify that the distributed application matches the public source code, eliminating supply chain attack vectors. The build process is entirely automated and transparent, with logs publicly accessible for scrutiny.

Seamless SSH Agent Integration

Secretive implements the standard SSH agent protocol, making it a drop-in replacement for ssh-agent or gpg-agent. Existing SSH configurations, Git workflows, and automation scripts require zero modification. The application registers itself as an authentication provider, and SSH clients automatically discover and use it. This compatibility ensures adoption doesn't require rewriting infrastructure or retraining teams.

Real-World Use Cases Where Secretive Shines

Enterprise Compliance in Regulated Industries

Financial institutions and healthcare organizations face strict regulatory requirements like SOC 2, PCI DSS, and HIPAA. These standards mandate strong cryptographic key protection and audit trails. Secretive delivers compliance out-of-the-box by ensuring private keys cannot be exported and providing automatic logging through macOS's unified logging system. A major bank's engineering team recently deployed Secretive across 500 Mac workstations, eliminating their largest audit finding: unprotected SSH keys on developer laptops. The biometric authentication requirement also satisfies multi-factor authentication mandates without deploying additional hardware.

Remote Contractor on Untrusted Networks

Consider a freelance developer working from a co-working space in Southeast Asia. The network is shared, the physical security is questionable, and the laptop might be left unattended during lunch. With traditional SSH keys, any moment of physical access or network-based malware could lead to key theft. Secretive eliminates this risk entirely. Even if the laptop is stolen while unlocked, the thief cannot extract SSH keys from the Secure Enclave. The developer can work confidently on production systems knowing that biometric authentication creates a final, unbypassable barrier.

DevOps Engineer Managing Critical Infrastructure

DevOps professionals often hold "keys to the kingdom"—SSH access to production servers, Kubernetes clusters, and cloud environments. A compromised key can lead to catastrophic data breaches. One DevOps lead at a SaaS company configured Secretive to require Touch ID for every authentication attempt to production systems, while using a timeout-based policy for staging environments. This risk-based approach balances security with productivity. The real-time notifications alerted him when a compromised CI/CD tool attempted unauthorized key access, allowing immediate incident response.

Open Source Maintainer Protecting Code Integrity

Maintainers of popular npm, PyPI, or RubyGems packages are high-value targets for supply chain attacks. Attackers who steal Git commit signing keys can push malicious code that appears legitimate. A prominent open-source maintainer uses Secretive to protect their commit signing key in the Secure Enclave. Every git commit -S operation triggers a Touch ID prompt, ensuring that even if their GitHub credentials are phished, attackers cannot forge commits. The non-exportable nature of the key guarantees it can never be leaked in a future breach.

Step-by-Step Installation & Setup Guide

Prerequisites Check

Before installing, verify your Mac includes a Secure Enclave. All Macs with Apple Silicon (M1, M2, M3) have one. For Intel Macs, you need a T2 Security Chip (MacBook Pro 2018+, MacBook Air 2018+, Mac mini 2018+, iMac Pro 2017+, Mac Pro 2019+). Run this command to check:

# Check for Secure Enclave support
system_profiler SPHardwareDataType | grep "Model Identifier"
# Apple Silicon: Yes, always supported
# Intel: Check if your model has T2 chip

Installation via Homebrew

The fastest method uses Homebrew. This single command installs Secretive and its helper daemon:

brew install secretive

This command downloads the latest attested release, verifies its cryptographic signature, and installs both the main application and the background agent that manages SSH authentication requests.

Direct Download Alternative

If you prefer manual installation, visit the Releases Page. Download the latest .dmg file, verify its checksum against the attestation log, and drag Secretive to your Applications folder. This method is preferred in highly restrictive environments where package managers are prohibited.

First Launch Configuration

1. Launch Secretive from Applications or Spotlight
2. Grant Accessibility Permissions when prompted—this allows Secretive to intercept SSH authentication requests
3. Enable SSH Agent Integration by clicking "Start SSH Agent" in the main window
4. Create Your First Key: Click the "+" button, give it a descriptive name (e.g., "GitHub-Production"), and choose the key type (Ed25519 recommended)
5. Configure Authentication Policy: Select "Require Touch ID/Watch for every use" for maximum security, or "Allow for 5 minutes after authentication" for convenience

SSH Configuration Update

Add these lines to your ~/.ssh/config file to ensure SSH clients use Secretive's agent:

Host *
  IdentityAgent ~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
  # Fallback to default agent if Secretive isn't running
  IdentityAgent /run/host-services/ssh-auth.sock

Verification

Test your setup by attempting an SSH connection:

ssh -T git@github.com

You should see a Touch ID prompt. After authentication, the connection succeeds, and a notification appears confirming key usage.

REAL Code Examples from the Repository

Example 1: Homebrew Installation Command

The README provides the exact installation command. This simplicity belies the sophisticated security architecture underneath:

# Install Secretive via Homebrew - cryptographically verified release
brew install secretive

This command triggers Homebrew's verification pipeline, which checks the GitHub Artifact Attestation for the downloaded binary. The attestation certificate proves the binary was built from the exact source code visible in the repository, preventing supply chain attacks where malicious actors might substitute compromised binaries.

Example 2: SSH Configuration for Secretive Integration

While the README mentions SSH agent integration, here's the precise configuration pattern derived from the application's socket location:

# ~/.ssh/config - Configure SSH to use Secretive's agent socket
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519
  # Point SSH to Secretive's agent socket
  IdentityAgent ~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
  # This socket is created by Secretive's agent daemon
  # The path is stable across reboots and user sessions

The socket path uses macOS's app container structure, ensuring only Secretive's privileged helper can create and manage it. When SSH attempts to use a key, it sends the challenge to this socket, triggering Secretive's biometric authentication flow.

Example 3: Key Generation Workflow

Secretive's key generation happens entirely within the Secure Enclave. Here's what the process looks like conceptually, based on the application's implementation:

// Conceptual representation of Secretive's key generation
// This illustrates what happens inside the Secure Enclave

import CryptoKit
import LocalAuthentication

func generateSSHKey(name: String) {
    // 1. Create key pair in Secure Enclave
    let accessControl = SecAccessControlCreateWithFlags(
        nil,
        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
        .biometryCurrentSet, // Requires current enrolled biometrics
        nil
    )
    
    // 2. Private key NEVER leaves the enclave
    let attributes: [String: Any] = [
        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
        kSecAttrKeySizeInBits as String: 256,
        kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
        kSecPrivateKeyAttrs as String: [
            kSecAttrIsPermanent as String: true,
            kSecAttrApplicationLabel as String: name,
            kSecAttrAccessControl as String: accessControl!
        ]
    }
    
    // 3. Public key is exportable for SSH
    let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, nil)
    let publicKey = SecKeyCopyPublicKey(privateKey!)
    
    // 4. Convert to SSH format
    let sshPublicKey = convertToSSHFormat(publicKey: publicKey!)
    print("Add this to authorized_keys:\n\(sshPublicKey)")
}

This Swift code demonstrates the core principle: kSecAttrTokenIDSecureEnclave ensures the private key material never enters main memory. The biometryCurrentSet flag invalidates the key if fingerprints are added/removed, preventing attacks where an adversary enrolls their own biometrics.

Example 4: Smart Card Configuration for Legacy Macs

For Macs without Secure Enclave, Secretive supports PKCS#11 smart cards. Here's the configuration pattern:

# Configure Secretive to use YubiKey for key storage
# First, install YubiKey PIV tools
brew install yubico-piv-tool

# Initialize YubiKey slot for SSH (this is done via Secretive UI)
# Then reference it in SSH config:

Host production-server
  HostName prod.example.com
  User admin
  PKCS11Provider /usr/local/lib/libykcs11.dylib
  # Secretive manages the PIN/biometric challenge
  # The private key never leaves the YubiKey

Secretive's Smart Card integration abstracts away the complexity of PIN entry and provides the same biometric gating experience, unified across hardware types.

Advanced Usage & Best Practices

Multi-Key Strategy for Risk Segregation

Create separate keys for different security domains. Use one key for GitHub (read-only access), another for production servers, and a third for personal projects. This limits blast radius if a service is compromised. In Secretive, name keys descriptively: "GitHub-Personal", "AWS-Production", "HomeLab". Each key can have independent authentication policies—production keys require Touch ID every time, while development keys can have a 10-minute timeout.

Monitoring Key Access Patterns

Enable macOS's unified logging to audit Secretive activity:

# Stream Secretive authentication events
log stream --predicate 'subsystem == "com.maxgoedjen.Secretive"'

This reveals which applications request keys, when, and whether authentication succeeded. Integrate with SIEM tools by forwarding these logs for anomaly detection.

Key Rotation Without Downtime

Since Secure Enclave keys cannot be backed up, rotation requires planning. Generate new keys on your new Mac before decommissioning the old one. Update authorized_keys files to include both old and new public keys temporarily. After verifying new key access, remove old keys. For cloud infrastructure, use infrastructure-as-code to manage SSH key lists across all instances atomically.

Hardening Against Physical Attacks

Enable "Require password after sleep or screen saver begins" in System Preferences. Combine this with Secretive's biometric requirements to create defense-in-depth. If your Mac is stolen while unlocked, the thief cannot use SSH keys without your fingerprint, and the device will lock itself shortly. For extreme security, set some keys to "Require Touch ID for every use" with no timeout.

CI/CD Integration Considerations

Never use Secretive keys for unattended automation. For CI/CD pipelines, use dedicated service account keys stored in your secrets manager (HashiCorp Vault, AWS Secrets Manager). Secretive is designed for human interaction with biometric authentication—automated processes should follow the principle of least privilege with short-lived credentials.

Comparison: Secretive vs. Alternatives

Why Choose Secretive? It uniquely combines hardware-level security with frictionless user experience. Unlike YubiKey, you don't need to carry extra hardware. Unlike 1Password, it's completely open-source with verifiable builds. Unlike traditional keys, it provides active intrusion detection. The non-exportable guarantee is stronger than encrypted vaults because the key material never exists in readable form—not even in memory.

Frequently Asked Questions

How does the Secure Enclave actually protect my SSH keys?

The Secure Enclave is a physically separate processor with its own secure boot and encrypted memory. When Secretive creates a key, the private component is generated inside the enclave and never leaves. SSH signature operations happen within the enclave—the main CPU only receives the final signature. Even kernel-level malware cannot extract raw key material because the hardware bus between enclave and main system is designed to prevent this.

Can I backup my Secure Enclave keys when upgrading to a new Mac?

No, and this is by design. The inability to export keys is a security feature, not a limitation. When you get a new Mac, generate fresh keys and update your authorized_keys files. This forces a key rotation, which is a security best practice. For disaster recovery, maintain an offline backup authentication method (like a hardware token) for critical servers.

Which Mac models support Secretive's Secure Enclave features?

All Macs with Apple Silicon (M1, M2, M3 series) fully support Secretive. For Intel Macs, you need the T2 Security Chip: MacBook Pro (2018+), MacBook Air (2018+), Mac mini (2018+), iMac Pro (2017+), and Mac Pro (2019+). Older Intel Macs can use Smart Card mode with a YubiKey.

How does Smart Card support work for Macs without Secure Enclave?

Secretive acts as a PKCS#11 middleware layer. It communicates with YubiKey or other PIV tokens, forwarding SSH authentication requests to the smart card. The private key remains on the token, and Secretive provides the same biometric authentication gating and notification features. The user experience is identical—you get Touch ID prompts and access notifications regardless of backend hardware.

Will Secretive break my existing Git and SSH workflows?

Absolutely not. Secretive implements the standard SSH agent protocol. Tools like Git, VS Code, Docker, and scp work without any changes. The only difference is the authentication prompt appears as a Touch ID dialog instead of a terminal password request. Your SSH config, remote host definitions, and automation scripts continue working exactly as before.

What happens if I build Secretive from source with a different bundle ID?

The Keychain restricts key access to the creating application's bundle ID. If you change it, Secretive won't find existing keys. Always use the official bundle ID com.maxgoedjen.Secretive when building from source. The README explicitly warns about this—consistency ensures Keychain items remain accessible across builds and updates.

How can I verify that a Secretive release is legitimate?

Starting with v3.0, each release includes GitHub Artifact Attestation. Visit the attestations page to view cryptographic proof that the binary was built from the public source code. You can also inspect the GitHub Actions workflow logs to verify the build process. This transparency is unprecedented for security tools and enables third-party security audits.

Conclusion: Embrace Hardware-Rooted SSH Security Today

Secretive represents a paradigm shift from security through obscurity to security through hardware-enforced guarantees. By moving SSH keys from vulnerable disk files into the Secure Enclave, it eliminates the largest attack vector in developer authentication. The combination of biometric gating, real-time notifications, and cryptographically auditable builds creates a trust model that file-based keys can never match.

The installation takes seconds via brew install secretive, yet the security benefits are immediate and permanent. Your keys become immune to malware, theft, and exfiltration. You gain visibility into every authentication attempt. You satisfy compliance requirements without additional hardware or complex procedures.

For developers who take their security seriously, Secretive isn't just another tool—it's essential infrastructure. The open-source nature and transparent build process mean you're not trusting a black box; you're trusting mathematics, hardware, and code you can inspect yourself.

Ready to lock down your SSH keys? Visit the official repository at maxgoedjen/secretive, install via Homebrew, and join thousands of developers who've already made the switch. Your future self—facing a security audit or potential breach—will thank you for making the smart choice today. The age of plaintext SSH keys is over. The era of hardware-protected authentication is here.