[water8]

Sounds like one big security nightmare by a startup who wont have the resources to manage it all. Trusting someone else to manage your secrets is big mistake e in almost every aspect in life. Crystal ball says: Hacked, Bankrupt

[npoturnak]

Appreciate your feedback. We have been prioritizing security from day one. We are SOC2 compliant, have conducted white box penetration with Cure53 to validate designs and crypto, architected our platform with modern protocols such as FIDO2, DID, OIDC. And we have been very transparent with what we do, so everyone can see the detailed flows and how the platform works https://docs.idemeum.com/security-whitepaper.html

[danenania]

In most cases, attempting to roll your own secrets management (or just ignoring secrets management entirely) will end up spraying access across all kinds of third party services (usually in plain text), as engineers resort to sharing secrets via email, chat, file sharing, and other tools to get their work done. The cost/benefit/risk calculation of trying to do this all yourself isn't good.

Using open source/self-hosted secrets management tools can be a good middle ground that requires less trust while still providing secure sharing options to engineers so they don't resort to egregiously insecure methods. Disclaimer: I'm the founder of just such a tool - https://envkey.com (we're adjacent to Idemeum but are focused specifically on application-level configuration and secrets, not passwords or SSO).