The tools were built for a different shape of team
Enterprise vaults assume a dedicated platform team to run them. Password managers assume a human copying a value out. Neither fits a five-person team shipping to production on a Tuesday afternoon.
About Shortspan
A credential you never stored is one nobody can steal.
Shortspan started with a familiar mess: a production database password in a pinned Slack message, three SSH keys of unknown provenance, and no way to answer who had touched what. We built the tool we wanted instead of writing another policy document about it.
Why we built it
Every team solves this badly, and privately.
Nobody publishes their credential-sharing workaround. That is how the same broken pattern survives in thousands of teams at once.
So teams improvise
A .env file in a Slack DM. A shared key in the team password manager. A “temporary” credential from 2023 that everyone is now afraid to rotate. It works right up until it does not.
The fix is not more storage
The fix is to stop storing. If a credential only exists during the seconds it is being used, most of what makes credential leakage catastrophic simply stops applying.
What we believe
Six positions we will not quietly abandon.
These are the commitments behind the product decisions. If we ever break one, hold us to it.
The terminal is the product
Developers live in a shell, not in a dashboard. The web console exists for administration and approvals; everything you do daily is a command you can type from muscle memory.
Deny rather than fail open
When we cannot verify something, we refuse. That occasionally costs you a minute. It never costs you an incident, and it means there is no cached credential for an attacker to find.
Security defaults are not a paid tier
Encryption, MFA, device management, and audit-grade logging are on the free plan. Charging for the parts that keep people safe would make the product worse at its job.
Say what is true, including what is missing
Our compliance page lists what is in progress alongside what is done. If a control is not built yet, we say so - you will find out eventually, and it is better that you hear it from us.
Your data is yours to leave with
Export everything, any time, in machine-readable form, with no fee and no notice period. Lock-in is not a retention strategy we are willing to use.
Small on purpose
We would rather answer your security questionnaire ourselves than hire a team to route it. That constrains how fast we grow, and it is a trade we are making deliberately.
The name
Two meanings, both deliberate.
We went through a long list before this one. It survived because it describes what the product does twice over.
A short span of time
The lifetime of a credential. Minutes, not months. Long enough to do the work, too short to be worth stealing.
A span that bridges a gap
The distance between a developer and the infrastructure they need. Shortspan crosses it on demand and then withdraws.
shortspan.dev/the CLI is called `shortspan`, and it answers to `ssp`
Find us
Real addresses, answered by people.
No ticket portal, no chatbot, no tier-one script. Email goes to the people who build the thing.
- General & support
- support@shortspan.dev
- Sales & Enterprise
- sales@shortspan.dev
- Security reports
- security@shortspan.dev
- Documentation
- docs.shortspan.dev
- Source & advisories
- github.com/shortspan
- System status
- status.shortspan.dev
Shortspan Technologies
-
-
The best time to fix this was before the incident.
Start with one project and one server. If it does not make your week easier within an hour, tell us why - we will actually read it.