Secretus

Secretus is an encrypted secret sharing service. It addresses the need to transmit sensitive information such as passwords, keys, or credentials without exposing them to intermediaries or persistent storage risks.

The service provides three distinct encryption modes. AES-256-GCM one-time links allow asynchronous sharing that expires after a single access. Authenticated peer-to-peer connections rely on ML-KEM-768 hybrid key agreement for direct recipient exchange. Shamir k-of-n Team Split enables division of a secret across multiple parties so that a defined threshold of shares is required for reconstruction. All modes operate with end-to-end encryption and default to strong security parameters.

Delivery occurs through a web application at secretus.app. The implementation incorporates a Content Security Policy that sets frame-ancestors to none to block clickjacking, along with HSTS, X-Content-Type-Options, and Referrer-Policy headers. DynamoDB appears in the connect-src directive to support direct browser SDK calls restricted to GetItem operations. Cognito hosted UI handles OAuth flows. A known configuration permits specific domains for Google Tag Manager and Cookiebot consent management because of technical constraints around script rotation, missing CORS headers, and the limitations of static nonces.