- Write-only — values can't be read back through the UI or the API, only rotated or deleted. You lose a value, you replace it.
- One reassurance banner at the top that explains the trust model in plain language. No tooltips, no hover-reveals.
- Table with 4 columns: NAME · masked VALUE · last used · actions (rotate / delete). Rows hover-highlight only.
- .env paste shortcut — drop KEY=value lines into NAME and we split them into N separate secrets.
- Failed run → direct deep link to the expired secret (e.g. run.html error "Update IG_SESSIONID" jumps straight here).
- No groups, no environments (yet) — each app has its own flat list. Shared secrets come later if users ask for it.
Reference: Vercel environment variables, GitHub repo secrets. Calm, masked, action-oriented. Security screens should reassure by being boring, not by having ten padlock icons.