Homelabs and small platforms drown in notes full of passwords. A React/Express/SQLite cockpit with encryption is often enough.
The product is restore drills and key handling — not another UI skin.
Encryption without ops is theater
Document where the key lives, how it rotates, and how backups restore.
Keep the API tiny so the threat model stays understandable.
Takeaways
- Right-size secret storage to the team.
- Backup keys and SQLite together.
- Prefer boring stacks you can explain.