Secret Sharing

The Vault allows you to share individual secrets with external parties via secure, time-limited, token-based links. This is useful for sending credentials to clients, contractors, or anyone who needs temporary access to a specific secret without having a concorbit account.

How Sharing Works

When you share a secret, concorbit generates a unique URL containing a cryptographically random 64-character token. The recipient opens this URL in their browser and clicks a button to reveal the decrypted secret. No authentication is required to view a shared secret, the token itself serves as the access credential.

The shared link is subject to two constraints:

• Expiry time: The link becomes invalid after the specified number of hours.

• View limit (optional). The link becomes invalid after being viewed a specified number of times.

Once either constraint is exceeded, the link shows an "expired" message and the secret can no longer be revealed through that link.

Creating a Shared Link

1. Navigate to the secret you want to share in the Vault.

2. Click the Share button.

3. Choose how to share. The share dialog offers two modes:

   • External link: Generate a tokenised URL that anyone can open without an account. This is the public link described throughout this guide.

   • Portal contact: Share the secret directly to a CRM contact's portal Vault page. This mode does not produce a public link, the contact reveals the secret after logging into the portal.

4. Configure the share settings:

1. Click Generate link (External link mode) or Share (Portal contact mode).

2. For an external link, concorbit generates the URL and displays it. Copy the URL and send it to the recipient via your preferred channel (email, messaging app, etc.).

Share URL Format

Shared secret URLs follow this format:

https://{your-subdomain}.concorbit.com/vault/shared/{token}

The {token} is a 64-character random string. The URL is tenant-specific (served from your subdomain) and displays your tenant branding.

What the Recipient Sees

When a recipient opens a shared link, they see:

1. Your branding: Your company name and accent color are displayed.

2. Secret name: The name of the shared secret is shown (e.g., "Production Database").

3. Expiry information: The date and time when the link expires.

4. Views remaining: If a view limit was set, the number of remaining views is shown.

5. "View your secret" button: The recipient must click this button to reveal the secret.

The reveal is a deliberate two-step process. The initial page load does not decrypt or display the secret. This design prevents email link scanners, browser prefetchers, and URL preview generators from consuming view limits or exposing the secret contents.

After Clicking "View your secret"

The secret is decrypted server-side and displayed:

• Username: If the secret has a stored username, it is shown with a copy button.

• Secret value: The decrypted password, key, or note content, with a copy button.

• Notes: If the secret has notes, they are shown below the value.

Each field has a Copy button for easy clipboard access.

Expiry and View Limits

Time-Based Expiry

The link becomes invalid once the specified number of hours has elapsed from the moment of creation. After expiry:

• The shared link page displays a "Link expired" message.

• No secret data is accessible.

• The expired share remains in the database for audit purposes but cannot be reactivated.

View-Based Expiry

If a max views limit was set, the link becomes invalid once the view count reaches the limit. The view count increments each time the recipient clicks "View your secret" (not on the initial page load). After the limit is reached:

• Subsequent visits show the expired/invalid message.

• The first view timestamp is recorded for audit purposes.

Combined Constraints

When both a time expiry and a view limit are set, the link expires when either constraint is met, whichever comes first.

Revoking Shared Access

You can revoke an individual share directly from the Vault. Open the secret's Share panel, where active shares are listed with their expiry and view count, and click Revoke next to the share you want to cancel. The public link stops working (and any associated portal entry disappears) immediately.

You can also revoke access by changing the underlying secret:

1. Wait for expiry: If the expiry window is short, the link will become invalid on its own.

2. Change the secret value: Edit the secret in the Vault and update its value. The shared link will still work until it expires, but the revealed value will be the old (now-invalid) credential.

3. Delete the secret: If the secret is deleted from the Vault, the shared link will no longer be able to decrypt the value.

For maximum security, use short expiry windows and low view limits when sharing sensitive credentials.

Sharing to a Portal Contact

Instead of a public link, you can share a secret directly to a CRM contact by choosing Portal contact mode. This provides:

• Portal access: The shared secret appears on the contact's portal Vault page, where they reveal it after logging into the portal (see Vault in Client Portal).

• Tracking: The audit log records which contact the share was created for.

A portal-contact share does not generate a public URL. Use External link mode (no contact) when you need an anonymous link that anyone with the URL can open.

Security Considerations

Token Security

• Shared link tokens are 64 characters of cryptographically random data, making them infeasible to guess.

• Tokens are transmitted in the URL path, so they appear in browser history and server logs. For maximum security, advise recipients to use private/incognito browsing.

Transmission

• concorbit does not send the shared link for you. You are responsible for transmitting the URL to the recipient via a secure channel.

• Consider using an encrypted messaging service rather than plain email for highly sensitive credentials.

Link Scanner Protection

The two-step reveal process (page load, then explicit button click) protects against:

• Email link scanners: Corporate email security tools that follow links to check for malware will not trigger a reveal.

• Browser prefetchers: Browsers that pre-load linked pages will not decrypt the secret.

• URL preview generators: Chat applications that generate link previews will not consume view limits.

The reveal happens via a separate POST request that only fires when the human recipient clicks the button.

Recommendations

• Use the shortest practical expiry window. For one-time credential delivery, use 1-24 hours with a max views of 1-2.

• Always rotate the credential after the recipient has set it up, especially for long-lived shared links.

• Use the contact association feature so you have an audit trail of who the credential was shared with.

• Avoid sharing secrets with unlimited views and long expiry windows unless absolutely necessary.

Audit Trail for Shared Secrets

All share activity is recorded in the vault audit log:

• Share creation: Logged when you create a shared link, including the target contact (if any) and the expiry configuration.

• Share reveal: Logged when a recipient reveals the secret via a shared link, including the contact ID (if associated) and the actor type ("Contact" for portal reveals).

See Access Control & Tiers for more details on the audit log.