Slack-native ephemeral secret sharing with Fernet encryption and full audit log

The problem

Credentials shared over Slack DMs or email persist indefinitely, are visible in channel history, and leave no audit trail. The team needed a way to hand off secrets that automatically expire and leave no trace after delivery.

Approach

• Slack-native recipient selection and delivery that fits an existing team workflow
• Authenticated requests, encrypted storage, and one-time reveal semantics built with reviewed libraries
• Configurable expiry with atomic destruction after use or expiration
• Abuse controls and concurrency-safe access that prevent repeated or simultaneous reveals
• Redacted lifecycle auditing that records operational events without copying secret values
• FastAPI service with MySQL 9 persistence and repeatable production deployment

Outcome

• Credentials never persist in Slack history — the one-time link burns on read or expiry, and the encrypted content is nullified immediately after
• Credential handoff fits the team's existing communication workflow with minimal friction
• Full audit trail of every secret lifecycle event without storing sensitive values, giving security teams visibility without exposure