jitpass/jit protects plaintext secrets on Macs by encrypting them behind Touch ID. It secures files like `.env`, `~/.aws/credentials`, and shell exports, rewriting them with decoys while keeping tools functional. Secrets appear in memory only when requested, requiring biometric approval.

The tool works with CLIs (AWS, Docker, GitHub) and shells. It scans for secrets, migrates them to a local vault, and integrates via `jit run -- <cmd>`. Installation via Homebrew or source includes shell completion. Homebrew ensures Gatekeeper clearance, while source builds require manual setup.

Key commands include `jit scan` (read-only), `jit migrate` (apply changes), and `jit run` (inject secrets per process). GitHub, Touch ID, and Apple Silicon are central to its design. Upgrades and migrations preserve vault integrity.

jitpass/jit prioritizes local-first security. It avoids cloud storage, signing releases with a Developer ID, and notarizing via Apple. Users control vault access, with two Touch ID moments: one to unlock the vault and another per credential request. This prevents unauthorized access even if the vault is open.