fix: unambiguous repo key names, clearer config and key names, and a newer lazysecrets's files no longer stop an older one

CHANGELOG.md

@@ -2,19 +2,6 @@
 
 Every release of lazysecrets, newest first.
 
-## v0.1.2 – 2026-10-13
-
-### Added
-
-- Look for repos in the usual folders, not just ~/git ([#57](https://git.kebcloud.no/keb/lazysecrets/pulls/57)) ([47ef862](https://git.kebcloud.no/keb/lazysecrets/commit/47ef86293d757f965069b1ea100a4d53d5a9b876))
-- Config grouped by area, with per-provider timeouts and an update interval ([#60](https://git.kebcloud.no/keb/lazysecrets/pulls/60)) ([10d1fc6](https://git.kebcloud.no/keb/lazysecrets/commit/10d1fc63c75fbb91088119a2e81884e44c36c4a3))
-- The update changelog covers every version you missed ([#61](https://git.kebcloud.no/keb/lazysecrets/pulls/61)) ([75bab25](https://git.kebcloud.no/keb/lazysecrets/commit/75bab2528677086219817ff9bc08a36755c96dcd))
-
-### Fixed
-
-- Help and errors name sharing.key and sharing.keyRules, not share.* ([#64](https://git.kebcloud.no/keb/lazysecrets/pulls/64)) ([6b3edd4](https://git.kebcloud.no/keb/lazysecrets/commit/6b3edd45d83b9b2af06a40f1f7e67f35c6861a69))
-- Unambiguous repo key names, clearer config and key names, and a newer lazysecrets's files no longer stop an older one ([#66](https://git.kebcloud.no/keb/lazysecrets/pulls/66)) ([a81fcaa](https://git.kebcloud.no/keb/lazysecrets/commit/a81fcaa5a6cef3ce0d07d6195f3e7bbb98808253))
-
 ## v0.1.1 – 2026-10-13
 
 ### Added

README.md

@@ -92,7 +92,7 @@ use most:
   secret
 - [Config](docs/config.md): every option, themes, layered configs, the
   state file
-- [Development](docs/development.md): building, tests, how changes land and
+- [Development](docs/development.md): building, tests, pull requests and
   releasing
 
 ## Privacy

SECURITY.md

@@ -1,11 +0,0 @@
-# Security
-
-Please report a vulnerability privately, not in a public issue:
-
-- on GitHub, with **Report a vulnerability** under the
-  [Security tab](https://github.com/karleinarb/lazysecrets/security), or
-- by email to karl-einarb@outlook.com.
-
-Say what's affected, how to reproduce it and the version
-(`lazysecrets --version`). Fixes go into the next release, and only the
-latest release gets them.

cmd/lazysecrets/main.go

@@ -123,7 +123,7 @@ func run() error {
                                   for scripts: VAR=$(lazysecrets get <ref>)
   lazysecrets [flags] share [--key <secret>] <env file>...
                                   print a link to env files of a repo, encrypted
-                                  with a secret's value (default: sharing.key)
+                                  with a secret's value (default: share.key)
   lazysecrets [flags] keybindings print every action and its keys (with your
                                   config applied), as config to copy and edit
   lazysecrets handler install [--terminal NAME]

cmd/lazysecrets/share.go

@@ -17,12 +17,12 @@ import (
 )
 
 // shareFiles prints a share link to env files of one repo, encrypted with
-// the --key secret's value, else the repo's or the config's sharing.key:
+// the --key secret's value, else the repo's or the config's share.key:
 //
 //	lazysecrets share .env apps/api/.env
 func shareFiles(ctx context.Context, providers []provider.Provider, st *store.Store, general string, rules share.Rules, args []string, out io.Writer) error {
 	fs := flag.NewFlagSet("share", flag.ContinueOnError)
-	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: sharing.key)")
+	keyLink := fs.String("key", "", "the secret to encrypt with: its lazysecrets:// link, Key Vault URL or reference (default: share.key)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
@@ -73,7 +73,7 @@ func shareFiles(ctx context.Context, providers []provider.Provider, st *store.St
 		return err
 	}
 	if !ok {
-		return errors.New("which secret to encrypt with? --key <secret>, or sharing.key in the repo's .lazysecrets.yaml or the config")
+		return errors.New("which secret to encrypt with? --key <secret>, or share.key in the repo's .lazysecrets.yaml or the config")
 	}
 	v, version, err := readKey(ctx, providers, st, key)
 	if err != nil {
@@ -87,7 +87,7 @@ func shareFiles(ctx context.Context, providers []provider.Provider, st *store.St
 	return err
 }
 
-// shareRules are the config's sharing.keyRules.
+// shareRules are the config's share.keyRules.
 func shareRules(cfg config.Config) share.Rules {
 	return share.Rules{MinLength: cfg.Sharing.KeyRules.MinLength, MinClasses: cfg.Sharing.KeyRules.MinClasses}
 }

docs/development.md

@@ -22,7 +22,7 @@ Development builds show `dev-<commit>` as their version (`-dirty` with
 uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
 version they were built for.
 
-## How changes land
+## Pull requests
 
 Pull requests into `main` are squash-merged, so each is one commit titled
 like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)

internal/provider/fake/fake.go

@@ -332,7 +332,7 @@ func Azure(delay time.Duration) *Provider {
 	}, demoCert)
 
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
-	// A key to share env files with (S → f): random, as sharing.keyRules wants.
+	// A key to share env files with (S → f): random, as share.keyRules wants.
 	p.add(shared, provider.TypeSecret, provider.Object{
 		Name: "env-share", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
 	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")

internal/provider/repo/repo.go

@@ -607,7 +607,7 @@ type lazysecretsFile struct {
 	} `yaml:"sharing"`
 }
 
-// ShareKey is the sharing.key of the repo's .lazysecrets.yaml, if any.
+// ShareKey is the share.key of the repo's .lazysecrets.yaml, if any.
 func ShareKey(root string) (string, error) {
 	b, err := os.ReadFile(filepath.Join(root, ".lazysecrets.yaml"))
 	if errors.Is(err, os.ErrNotExist) {

internal/share/rules.go

@@ -53,7 +53,7 @@ func (r Rules) Check(key []byte) error {
 	if len(has) == 0 {
 		return nil
 	}
-	return fmt.Errorf("its value has %s; sharing.keyRules needs %s",
+	return fmt.Errorf("its value has %s; share.keyRules needs %s",
 		strings.Join(has, " and "), strings.Join(needs, " and "))
 }
 

internal/share/share.go

@@ -259,8 +259,8 @@ func CheckPath(p string) error {
 	return nil
 }
 
-// DefaultKey is the key for a repo's files: sharing.key in the repo's
+// DefaultKey is the key for a repo's files: share.key in the repo's
-// .lazysecrets.yaml, else general (sharing.key in the config). ok is false
+// .lazysecrets.yaml, else general (share.key in the config). ok is false
 // when neither names one.
 func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	link, err := repo.ShareKey(root)
@@ -276,7 +276,7 @@ func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	}
 	key, err = ParseKey(link)
 	if err != nil {
-		return ref.Ref{}, false, fmt.Errorf("sharing.key in %s: %w", where, err)
+		return ref.Ref{}, false, fmt.Errorf("share.key in %s: %w", where, err)
 	}
 	return key, true, nil
 }

internal/ui/app/app.go

@@ -87,7 +87,7 @@ type Options struct {
 	// CacheFile keeps what was loaded between runs; "" keeps it for this
 	// run only.
 	CacheFile string
-	// ShareKey is the config's sharing.key: the secret that encrypts shared
+	// ShareKey is the config's share.key: the secret that encrypts shared
 	// env files, for repos whose .lazysecrets.yaml names none.
 	ShareKey string
 	// ShareRules are what a key's value must be to share with it.
@@ -284,8 +284,8 @@ type Model struct {
 	linked     []provider.Container // vaults opened from links, this session
 	open       *ref.Ref             // reference to open at startup
 
-	shareKey   string      // the config's sharing.key
+	shareKey   string      // the config's share.key
-	shareRules share.Rules // and sharing.keyRules
+	shareRules share.Rules // and share.keyRules
 
 	// A lazysecrets:// link found on the clipboard, offered in the footer.
 	dismissedLink string // the last link offered: not offered again

internal/ui/app/sharefiles.go

@@ -38,7 +38,7 @@ type shareFilesMsg struct {
 type sealedMsg struct {
 	link ref.Ref
 	n    int
-	// from is the picker the key was picked in; nil for sharing.key's.
+	// from is the picker the key was picked in; nil for share.key's.
 	from *picker
 	err  error
 }

internal/ui/app/sharefiles_test.go

@@ -50,7 +50,7 @@ func shareFrom(t *testing.T, root string, paste bool) string {
 		t.Fatalf("selected %v, want the repo", src.ID)
 	}
 	d.keys("S", "f")
-	// No sharing.key set: it asks which secret, in Go to, which lists
+	// No share.key set: it asks which secret, in Go to, which lists
 	// only secrets.
 	v := d.m.search
 	if v == nil || v.picker == nil {
@@ -218,7 +218,7 @@ func TestShareInDemo(t *testing.T) {
 	}
 	// Too short a key: the picker stays, saying why.
 	d.send(tea.PasteMsg{Content: "https://kv-app-prod.vault.azure.net/secrets/db-password"})
-	if d.m.search == nil || !strings.Contains(d.m.search.picker.err, "Can't use db-password: its value has 28 characters; sharing.keyRules needs 32 (minLength)") {
+	if d.m.search == nil || !strings.Contains(d.m.search.picker.err, "Can't use db-password: its value has 28 characters; share.keyRules needs 32 (minLength)") {
 		t.Fatalf("not said in the picker: %v\n%s", d.m.search != nil, d.screen())
 	}
 	if !strings.Contains(d.screen(), "28 characters") {