🧭 Project Roadmap

A 12-month roadmap for building your Secure Cloud Secret Manager.

Phase 1: MVP Core Infrastructure
Month 1–2

Build the core system for personal and org-level secret storage.

🚀 Features

  • User authentication (email/password, OAuth optional)
  • Organization and personal spaces
  • CRUD for EnvData, SSHData, Passwords, Notes
  • Backend encryption using AES
  • Role-based access (Owner, Admin, Member)
  • 2FA and backup codes

🧰 Tech

  • Next.js API Routes
  • Prisma ORM + PostgreSQL
  • S3 for attachments
  • Zustand for state
  • tRPC (recommended) for type-safe APIs

🔒 Security

  • AES per record
  • Secure cookies + HTTP-only sessions
  • Hashed passwords (bcrypt)
Phase 2: Organization & Sharing Layer
Month 3–4

Enable collaboration across multiple orgs and role-based permissions.

🚀 Features

  • Create/join multiple organizations
  • Invite members via email
  • Assign roles and manage access
  • Share secrets across orgs with dropdown selector
  • Real-time sync or revalidation

🧰 Tech

  • Active organization context via Zustand
  • Optimized Prisma queries
  • Optional WebSocket sync
Phase 3: Advanced Security & Encryption
Month 5–6

Move toward zero-knowledge and client-side encryption.

🚀 Features

  • Per-user/org encryption keys
  • Client-side encryption (Web Crypto API)
  • Export/import encrypted backups
  • 2FA enforcement for sensitive actions

🧰 Tech

  • Encryption key versioning
  • KDF for encryption
  • Crypto.subtle integration in frontend
Phase 4: Developer Tools
Month 7–8

Expose APIs and CLI tools for developers.

🚀 Features

  • REST/tRPC API access
  • CLI tool for secrets management
  • Service tokens for CI/CD
  • SSO (Google, GitHub)

🧰 Tech

  • Scoped API keys
  • Rate limiting middleware
  • Postman/Swagger docs

🔒 Security

  • Hash API keys
  • Role/permission enforcement
Phase 5: Monetization
Month 9–10

Add billing and subscription tiers.

🚀 Features

  • Free & Paid tiers
  • Stripe billing integration
  • Organization-level billing
  • Feature flags for paid features

🧰 Tech

  • Stripe webhooks via Next.js API route
  • Prisma plan tracking
Phase 6: Observability & Scaling
Month 11–12

Improve reliability, monitoring, and admin features.

🚀 Features

  • Metrics & usage dashboard
  • Email notifications for critical events
  • Sentry/PostHog integration
  • Admin dashboard for managing users/orgs

🧰 Tech

  • Sentry for error tracking
  • Supabase/Neon for scalable Postgres
  • Feature flags for admin-only controls

🧠 Optional Add-ons

  • Audit Logs — toggle with ENABLE_AUDIT_LOGS=true
  • EncryptionKey & ApiKey schema for future encryption and CLI
  • Feature flags for paid tiers
  • Soft-delete flags for reversible deletions