---
title: Safe Quickstart
description: Create a local Cuitty Safe, replace env values with references, and resolve them at runtime.
section: Safe
order: 1
updatedAt: 2026-06-09
slug: safe/quickstart
---
# Safe Quickstart

Cuitty Safe lets you commit references such as `cuitty-safe:acme/dev/database-url` instead of raw secret values. The resolver injects the real value only at the runtime boundary.

## Install

Repository contributors should route package changes through Socket Firewall and pin exact versions.

```bash
sfw bun add @cuitty/safe@0.1.0
```

The CLI binary target is `cuitty-safe`. Some Cuitty installs may also expose it as `cui safe`.

## Create a local Safe

Local vault mode is the default first-run mode.

```bash
cuitty-safe init
cuitty-safe safe create acme/dev --provider local
cuitty-safe put acme/dev/database-url --value "$DATABASE_URL"
cuitty-safe put acme/ci/github-token --value "$GITHUB_TOKEN"
```

The values above come from your current shell. Do not paste real values into committed docs, scripts, or examples.

## Replace env values with references

```dotenv
DATABASE_URL=cuitty-safe:acme/dev/database-url
GITHUB_TOKEN=cuitty-safe:acme/ci/github-token
```

Bare paths are valid only when Cuitty Safe is the active resolver:

```dotenv
DATABASE_URL=acme/dev/database-url
```

## Run with resolved env

```bash
cuitty-safe run --env-file .env -- bun run dev
```

`run` resolves references, injects values into the child process environment, and keeps terminal output masked by default.

## Use package scripts

```jsonc
{
  "scripts": {
    "dev": "cuitty-safe run --env-file .env -- vite",
    "deploy": "cuitty-safe run --scope acme/prod -- bun run deploy:raw"
  },
  "cuittySafe": {
    "env": {
      "DATABASE_URL": "acme/dev/database-url",
      "GITHUB_TOKEN": "acme/ci/github-token"
    }
  }
}
```

Prefer `cuitty-safe run` over shell command substitution. Substitution can leak sensitive values into shell history, process listings, or logs.

## Next steps

- [Reference syntax](/docs/safe/references)
- [Storage modes](/docs/safe/storage-modes)
- [CI/CD](/docs/safe/ci-cd)
- [Security model](/docs/safe/security)