diff --git a/dev2/dev2-site b/dev2/dev2-site
index 16cd089..bc92ee5 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1232,10 +1232,18 @@ def cmd_provision(args):
     # Secrets come from the logicsrc team vault on every deploy (deploy-app.sh
     # sync_env_from_vault): sites.d "vault" names it, else <repo name>--prod; "vault": ""
     # turns it off. env_remove keys are never taken from the vault.
-    vault = s.get("vault", f"{s['repo'].split('/')[-1]}--prod" if s.get("repo") else "")
+    # logicsrc vault names are lowercase letters, digits and dashes: a repo like
+    # c0ncerts.com becomes c0ncerts-com--prod (a dotted name is refused, and the
+    # deploy then silently pulls nothing).
+    default_vault = (re.sub(r"[^a-z0-9-]+", "-", s["repo"].split("/")[-1].lower()).strip("-") + "--prod") if s.get("repo") else ""
+    vault = s.get("vault", default_vault)
     if vault:
         deploy_env += f"VAULT={vault}\nVAULT_TEAM={s.get('vault_team', 'profullstack')}\n"
-        deploy_env += f"VAULT_SKIP=\"{' '.join(s.get('env_remove') or [])}\"\n"
+        # vault_skip: keys never taken from the vault but kept in app.env (signing
+        # keys logicsrc refuses to store, values the vault cannot round-trip,
+        # vault-only keys the site does not use). env_remove keys are skipped too.
+        skip = sorted(set(s.get("env_remove") or []) | set(s.get("vault_skip") or []))
+        deploy_env += f"VAULT_SKIP=\"{' '.join(skip)}\"\n"
     ssh("root", f"install -d -m 2755 -o {DEPLOY_USER} -g {DEPLOY_USER} {root} {root}/volumes")
     for v in s["volumes"] + [v for c in s["companions"] for v in c.get("volumes", [])]:
         ssh("root", f"install -d -m 0777 {root}/volumes/{shlex.quote(v['name'])}")
diff --git a/dev2/sites.d/aiornot.vote.json b/dev2/sites.d/aiornot.vote.json
index d52ae7c..da0a1ad 100644
--- a/dev2/sites.d/aiornot.vote.json
+++ b/dev2/sites.d/aiornot.vote.json
@@ -10,5 +10,10 @@
  "redirect_to": {
   "default": "https://aiornot.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "COINPAY_API_URL",
+  "SEED_BATCH_SIZE",
+  "STORAGE_PROVIDER"
+ ]
 }
diff --git a/dev2/sites.d/app.logicsrc.com.json b/dev2/sites.d/app.logicsrc.com.json
index e756827..340b3c1 100644
--- a/dev2/sites.d/app.logicsrc.com.json
+++ b/dev2/sites.d/app.logicsrc.com.json
@@ -1,6 +1,10 @@
 {
  "start_command": "npm --workspace @logicsrc/pwa run start",
  "health_path": "/healthz",
- "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"],
- "notes": "The service is apps/pwa (Railway rootDirectory); the root .nixpacks CMD starts the Next marketing site instead, so the compose command overrides it. Turso -> shared Postgres 2026-09-25 (profullstack/logicsrc#218)."
+ "env_remove": [
+  "TURSO_DATABASE_URL",
+  "TURSO_AUTH_TOKEN"
+ ],
+ "notes": "The service is apps/pwa (Railway rootDirectory); the root .nixpacks CMD starts the Next marketing site instead, so the compose command overrides it. Turso -> shared Postgres 2026-09-25 (profullstack/logicsrc#218).",
+ "vault": "app-logicsrc-com--prod"
 }
diff --git a/dev2/sites.d/app.moshcode.sh.json b/dev2/sites.d/app.moshcode.sh.json
index 4b95cda..d961aa0 100644
--- a/dev2/sites.d/app.moshcode.sh.json
+++ b/dev2/sites.d/app.moshcode.sh.json
@@ -1,5 +1,8 @@
 {
  "health_path": "/healthz",
- "env_remove": ["DATABASE_AUTH_TOKEN"],
- "notes": "web app is apps/pwa (own deps); plain Dockerfile on main, health /healthz. Turso -> shared Postgres 2026-09-25 (moshcoder/moshcode#551): DATABASE_URL is rewritten to the cluster URL by provision, the Turso token retired"
+ "env_remove": [
+  "DATABASE_AUTH_TOKEN"
+ ],
+ "notes": "web app is apps/pwa (own deps); plain Dockerfile on main, health /healthz. Turso -> shared Postgres 2026-09-25 (moshcoder/moshcode#551): DATABASE_URL is rewritten to the cluster URL by provision, the Turso token retired",
+ "vault": "app-moshcode-sh--prod"
 }
diff --git a/dev2/sites.d/b1dz.com.json b/dev2/sites.d/b1dz.com.json
index 25537d1..641f7ae 100644
--- a/dev2/sites.d/b1dz.com.json
+++ b/dev2/sites.d/b1dz.com.json
@@ -14,5 +14,72 @@
  },
  "mem_limit": "2g",
  "node_heap_mb": 768,
- "mem_note": "2026-10-01: four node processes + redis in one container, 540 MB steady"
+ "mem_note": "2026-10-01: four node processes + redis in one container, 540 MB steady",
+ "vault_skip": [
+  "ARB_AUTO_SEED_COOLDOWN_MS",
+  "ARB_AUTO_SEED_EVAL_WINDOW_MS",
+  "ARB_AUTO_SEED_GLOBAL_USD",
+  "ARB_AUTO_SEED_MIN_USD",
+  "ARB_AUTO_SEED_PAUSE_MS",
+  "ARB_AUTO_SEED_PER_PAIR_USD",
+  "ARB_AUTO_SEED_PROFIT_RATIO",
+  "ARB_EXECUTOR_UNISWAP_BASE",
+  "ARB_LIQ_COOLDOWN_MS",
+  "ARB_LIQ_MAX_SLICE_USD",
+  "ARB_LIQ_MIN_ASSET_USD",
+  "ARB_MAX_TRADE_USD",
+  "ARB_MIN_NET_BPS",
+  "ARB_MIN_NET_USD",
+  "ARB_MODE",
+  "ARB_SIZE_USD",
+  "ARB_TRIANGULAR_ANCHOR",
+  "ARB_TRIANGULAR_FEE_TIER",
+  "ARB_TRIANGULAR_INTERVAL_MS",
+  "ARB_TRIANGULAR_MAX_PER_TICK",
+  "ARB_TRIANGULAR_MIN_NET_USD",
+  "ARB_TRIANGULAR_SIZE_USD",
+  "ARB_TRIANGULAR_TOKENS",
+  "BUY_SLIPPAGE_BPS",
+  "COINPAY_API_URL",
+  "DAILY_LOSS_LIMIT_PCT",
+  "DCA_COINS",
+  "DCA_ENABLED",
+  "DCA_EXCHANGES",
+  "DCA_INTERVAL_MS",
+  "DCA_MAX_COINS",
+  "DCA_TOTAL_ALLOCATION_PCT",
+  "DEX_SLIPPAGE_BPS",
+  "DEX_TRADE_BUDGET_USD",
+  "DEX_TRADE_EXECUTION",
+  "DEX_TRADE_MAX_USD",
+  "DOPPLER_CONFIG",
+  "DOPPLER_ENVIRONMENT",
+  "DOPPLER_PROJECT",
+  "ENABLE_PROXY",
+  "ENTRY_MIN_SCORE",
+  "EVM_WALLET_ADDRESS",
+  "GEMINI_NONCE_OFFSET",
+  "HARD_STOP_PCT",
+  "MIN_HOLD_SECS",
+  "MIN_NET_PROFIT_PCT",
+  "MIN_PER_EXCHANGE_VOL_USD",
+  "MIN_VOLUME_USD",
+  "PROXY_PASSWORD",
+  "PROXY_URL",
+  "PROXY_USERNAME",
+  "PUMPFUN_ENABLE_SCRAPE",
+  "PUMPFUN_TRADE_EXECUTION",
+  "PUMPFUN_TRADE_SOL",
+  "ROTATE_ADVERSE_PCT",
+  "ROTATE_MIN_HOLD_MS",
+  "SOLANA_WALLET_ADDRESS",
+  "TAKE_PROFIT_PCT",
+  "TRADING_ENABLED",
+  "V2_MAX_PAIRS",
+  "V2_MAX_TRADE_USD",
+  "V2_MIN_NET_BPS",
+  "V2_MIN_NET_USD",
+  "V2_MODE",
+  "V2_SIZE_USD"
+ ]
 }
diff --git a/dev2/sites.d/bittorrented.com.json b/dev2/sites.d/bittorrented.com.json
index fe051ae..440d3be 100644
--- a/dev2/sites.d/bittorrented.com.json
+++ b/dev2/sites.d/bittorrented.com.json
@@ -30,5 +30,10 @@
    "max_body": "512m"
   }
  ],
- "nginx_app": false
+ "nginx_app": false,
+ "vault_skip": [
+  "DOPPLER_CONFIG",
+  "DOPPLER_ENVIRONMENT",
+  "DOPPLER_PROJECT"
+ ]
 }
diff --git a/dev2/sites.d/brisk.news.json b/dev2/sites.d/brisk.news.json
index 24b9209..3a07ef8 100644
--- a/dev2/sites.d/brisk.news.json
+++ b/dev2/sites.d/brisk.news.json
@@ -18,5 +18,8 @@
   "default": "https://brisk.pwa.pit.world",
   "supabase.brisk.news": "https://brisk-supabase.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "X402_PRIVATE_KEY"
+ ]
 }
diff --git a/dev2/sites.d/c0ncerts.com.json b/dev2/sites.d/c0ncerts.com.json
index 7079083..88c4e98 100644
--- a/dev2/sites.d/c0ncerts.com.json
+++ b/dev2/sites.d/c0ncerts.com.json
@@ -17,5 +17,9 @@
   "default": "https://c0ncerts.pwa.pit.world",
   "supabase.c0ncerts.com": "https://c0ncerts-supabase.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "SUPABASE_DB_PASSWORD",
+  "SUPABASE_JWT_SECRET"
+ ]
 }
diff --git a/dev2/sites.d/coinpayportal.com.json b/dev2/sites.d/coinpayportal.com.json
index 13e14d7..f2bfbc2 100644
--- a/dev2/sites.d/coinpayportal.com.json
+++ b/dev2/sites.d/coinpayportal.com.json
@@ -28,5 +28,11 @@
   "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY"
  },
  "mem_limit": "2g",
- "mem_note": "2026-10-01: next + tor, 420 MB steady, 570 MB peak"
+ "mem_note": "2026-10-01: next + tor, 420 MB steady, 570 MB peak",
+ "vault_skip": [
+  "DOPPLER_CONFIG",
+  "DOPPLER_ENVIRONMENT",
+  "DOPPLER_PROJECT",
+  "REPUTATION_SIGNING_SECRET"
+ ]
 }
diff --git a/dev2/sites.d/crawlproof.com.json b/dev2/sites.d/crawlproof.com.json
index 805542f..f6f98bd 100644
--- a/dev2/sites.d/crawlproof.com.json
+++ b/dev2/sites.d/crawlproof.com.json
@@ -3,5 +3,13 @@
   "app": "3g"
  },
  "node_heap_mb": 1024,
- "mem_note": "predates the kit; next-server + tsx audit worker in one container, 730 MB steady"
+ "mem_note": "predates the kit; next-server + tsx audit worker in one container, 730 MB steady",
+ "vault": "crawlproof-com--prod",
+ "vault_skip": [
+  "BACKEND_AI_OPENAI_MODEL",
+  "BACKEND_AI_PROVIDER",
+  "CRAWLPROOF_DEV_BOX_TOKEN",
+  "GITHUB_APP_PRIVATE_KEY",
+  "X402_PRIVATE_KEY"
+ ]
 }
diff --git a/dev2/sites.d/d1sks.com.json b/dev2/sites.d/d1sks.com.json
index 7b3ce9a..6b74ae6 100644
--- a/dev2/sites.d/d1sks.com.json
+++ b/dev2/sites.d/d1sks.com.json
@@ -2,5 +2,9 @@
  "redirect_to": {
   "default": "https://d1sks.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "OPERATOR_URL",
+  "POLL_MINUTES"
+ ]
 }
diff --git a/dev2/sites.d/goingbroke.now.json b/dev2/sites.d/goingbroke.now.json
index 5723805..df968de 100644
--- a/dev2/sites.d/goingbroke.now.json
+++ b/dev2/sites.d/goingbroke.now.json
@@ -9,5 +9,8 @@
  "redirect_to": {
   "default": "https://goingbroke.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "PORT"
+ ]
 }
diff --git a/dev2/sites.d/hqtui.com.json b/dev2/sites.d/hqtui.com.json
index 26eeea2..5083632 100644
--- a/dev2/sites.d/hqtui.com.json
+++ b/dev2/sites.d/hqtui.com.json
@@ -1 +1,13 @@
-{ "branch": "main", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }
+{
+ "branch": "main",
+ "env_remove": [
+  "TURSO_DATABASE_URL",
+  "TURSO_AUTH_TOKEN"
+ ],
+ "vault_skip": [
+  "NPM_SCOPE",
+  "RAILWAY_PROJECT_ID",
+  "RAILWAY_SERVICE",
+  "RESEND_API_KEY"
+ ]
+}
diff --git a/dev2/sites.d/infernetprotocol.com.json b/dev2/sites.d/infernetprotocol.com.json
index 003abe5..cdb4a96 100644
--- a/dev2/sites.d/infernetprotocol.com.json
+++ b/dev2/sites.d/infernetprotocol.com.json
@@ -21,5 +21,8 @@
   "DOPPLER_CONFIG",
   "DOPPLER_ENVIRONMENT",
   "DOPPLER_PROJECT"
+ ],
+ "vault_skip": [
+  "DID_PRIVATE_KEY_BASE64"
  ]
 }
diff --git a/dev2/sites.d/installer.pairux.com.json b/dev2/sites.d/installer.pairux.com.json
index f1d2f2f..89ddc51 100644
--- a/dev2/sites.d/installer.pairux.com.json
+++ b/dev2/sites.d/installer.pairux.com.json
@@ -4,5 +4,10 @@
   "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
   "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.pairux.com",
   "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD"
- }
+ },
+ "vault": "installer-pairux-com--prod",
+ "vault_skip": [
+  "AUR_SSH_KEY",
+  "GPG_PRIVATE_KEY"
+ ]
 }
diff --git a/dev2/sites.d/logicsrc.com.json b/dev2/sites.d/logicsrc.com.json
index 358131a..c56d576 100644
--- a/dev2/sites.d/logicsrc.com.json
+++ b/dev2/sites.d/logicsrc.com.json
@@ -12,5 +12,16 @@
   "SUPABASE_SECRET_KEY": "secret:SUPABASE_SECRET_KEY",
   "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
   "SUPABASE_URL": "https://supabase.logicsrc.com"
- }
+ },
+ "vault_skip": [
+  "COMMANDBOARD_API_URL",
+  "CREDSHARE_EMAIL_FROM",
+  "DATABASE_URL",
+  "LOGICSRC_SCHEMA_VERSION",
+  "MIGRATE_DATABASE_URL",
+  "NODE_ENV",
+  "PUBLIC_ORIGIN",
+  "RESEND_API_KEY",
+  "SESSION_SECRET"
+ ]
 }
diff --git a/dev2/sites.d/media2markdown.com.json b/dev2/sites.d/media2markdown.com.json
index b3b8b81..0e50227 100644
--- a/dev2/sites.d/media2markdown.com.json
+++ b/dev2/sites.d/media2markdown.com.json
@@ -4,5 +4,11 @@
  "redirect_to": {
   "default": "https://media2markdown.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "ACCESS_PASSWORD",
+  "AUTH_EMAIL",
+  "AUTH_JWT_SECRET",
+  "AUTH_PASSWORD"
+ ]
 }
diff --git a/dev2/sites.d/meshhook.com.json b/dev2/sites.d/meshhook.com.json
index 0f34e2b..dd205df 100644
--- a/dev2/sites.d/meshhook.com.json
+++ b/dev2/sites.d/meshhook.com.json
@@ -7,5 +7,8 @@
   "TURSO_AUTH_TOKEN"
  ],
  "node_heap_mb": 384,
- "mem_note": "three node processes in one container"
+ "mem_note": "three node processes in one container",
+ "vault_skip": [
+  "X402_PRIVATE_KEY"
+ ]
 }
diff --git a/dev2/sites.d/moshcoding.com.json b/dev2/sites.d/moshcoding.com.json
index 6d2a6e3..3c22e73 100644
--- a/dev2/sites.d/moshcoding.com.json
+++ b/dev2/sites.d/moshcoding.com.json
@@ -1 +1,10 @@
-{ "branch": "master", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }
+{
+ "branch": "master",
+ "env_remove": [
+  "TURSO_DATABASE_URL",
+  "TURSO_AUTH_TOKEN"
+ ],
+ "vault_skip": [
+  "DATA_DIR"
+ ]
+}
diff --git a/dev2/sites.d/nichedb.dev.json b/dev2/sites.d/nichedb.dev.json
index bd0eed2..b68e65f 100644
--- a/dev2/sites.d/nichedb.dev.json
+++ b/dev2/sites.d/nichedb.dev.json
@@ -2,5 +2,10 @@
  "mem_limits": {
   "app": "6g"
  },
- "mem_note": "predates the kit (hand-made compose); Bun, 570 MB steady, 4.7 GB peak; redis maxmemory 2gb -> 3g"
+ "mem_note": "predates the kit (hand-made compose); Bun, 570 MB steady, 4.7 GB peak; redis maxmemory 2gb -> 3g",
+ "vault": "nichedb--prod",
+ "vault_skip": [
+  "NICHEDB_LYRICS_KEY",
+  "PORT"
+ ]
 }
diff --git a/dev2/sites.d/nixamp.com.json b/dev2/sites.d/nixamp.com.json
index 5a59848..3a201bb 100644
--- a/dev2/sites.d/nixamp.com.json
+++ b/dev2/sites.d/nixamp.com.json
@@ -2,5 +2,12 @@
  "mem_limit": "2g",
  "mem_note": "2026-10-01: Bun, 540 MB steady, 690 MB peak",
  "standby_port": 13216,
- "standby_note": "2026-10-21: deploys start the new build here first (nginx backup), so nixamp.com never shows the maintenance page"
+ "standby_note": "2026-10-21: deploys start the new build here first (nginx backup), so nixamp.com never shows the maintenance page",
+ "vault_skip": [
+  "FAL_KEY",
+  "NICHEDB_LYRICS_KEY",
+  "NIXAMP_OPENAI_MODEL",
+  "NIXAMP_OPENAI_URL",
+  "NIXAMP_WORKERS_AI_TOKEN"
+ ]
 }
diff --git a/dev2/sites.d/obscura.openmcp.logicsrc.com.json b/dev2/sites.d/obscura.openmcp.logicsrc.com.json
index b71a557..9aca1eb 100644
--- a/dev2/sites.d/obscura.openmcp.logicsrc.com.json
+++ b/dev2/sites.d/obscura.openmcp.logicsrc.com.json
@@ -2,5 +2,6 @@
  "image": "node:24-bookworm-slim",
  "start_command": "sh -c 'node -e \"fetch(process.argv[1]).then(r=>{if(!r.ok)throw new Error(r.status);return r.body.pipeTo(require(\\\"stream\\\").Writable.toWeb(process.stdout))})\" https://github.com/h4ckf0r0day/obscura/releases/download/v0.2.2/obscura-x86_64-linux-stealth.tar.gz | tar -xz -C /usr/local/bin obscura obscura-worker && until npx -y @logicsrc/openmcp@0.4.0 serve; do echo retrying in 20s; sleep 20; done'",
  "health_path": "/healthz",
- "notes": "stock node image: downloads the obscura binary then runs npx @logicsrc/openmcp (Railway startCommand); serves openmcp.logicsrc.com and obscura.openmcp.logicsrc.com"
+ "notes": "stock node image: downloads the obscura binary then runs npx @logicsrc/openmcp (Railway startCommand); serves openmcp.logicsrc.com and obscura.openmcp.logicsrc.com",
+ "vault": "obscura-openmcp-logicsrc-com--prod"
 }
\ No newline at end of file
diff --git a/dev2/sites.d/openaccess.logicsrc.com.json b/dev2/sites.d/openaccess.logicsrc.com.json
index 311d580..6685fc8 100644
--- a/dev2/sites.d/openaccess.logicsrc.com.json
+++ b/dev2/sites.d/openaccess.logicsrc.com.json
@@ -2,5 +2,6 @@
  "image": "node:24-alpine",
  "start_command": "sh -c 'until npx -y @logicsrc/openaccess@0.3.0 serve; do echo retrying in 20s; sleep 20; done'",
  "health_path": "/healthz",
- "notes": "stock node image running npx @logicsrc/openaccess (Railway startCommand)"
+ "notes": "stock node image running npx @logicsrc/openaccess (Railway startCommand)",
+ "vault": "openaccess-logicsrc-com--prod"
 }
\ No newline at end of file
diff --git a/dev2/sites.d/outreachgraph.com.json b/dev2/sites.d/outreachgraph.com.json
index debe6e9..83fe528 100644
--- a/dev2/sites.d/outreachgraph.com.json
+++ b/dev2/sites.d/outreachgraph.com.json
@@ -8,5 +8,22 @@
    "name": "emailqueue",
    "network": "mynapostercom_default"
   }
+ ],
+ "vault": "outreachgraph-com--prod",
+ "vault_skip": [
+  "ANTHROPIC_API_KEY",
+  "APP_VERSION",
+  "EMAIL_FROM",
+  "GEMINI_API_KEY",
+  "GITHUB_TOKEN",
+  "OPENAI_API_KEY",
+  "REDIS_URL",
+  "RESEND_API_KEY",
+  "SECRET_ENCRYPTION_KEY",
+  "SEORANK_API_KEY",
+  "TURSO_DATABASE_URL",
+  "VALUESERP_API_KEY",
+  "WORKERS_AI_TOKEN",
+  "WORKER_TICK_MS"
  ]
 }
diff --git a/dev2/sites.d/pairux.com.json b/dev2/sites.d/pairux.com.json
index 3cd4b88..39e8490 100644
--- a/dev2/sites.d/pairux.com.json
+++ b/dev2/sites.d/pairux.com.json
@@ -18,5 +18,16 @@
  },
  "keep_services": [
   "realtime"
+ ],
+ "vault_skip": [
+  "AUR_SSH_KEY",
+  "EXTELLA_AGENT_ID",
+  "EXTELLA_API_TOKEN",
+  "EXTELLA_EMAIL",
+  "EXTELLA_PASSWORD",
+  "EXTELLA_PIN",
+  "EXTELLA_USER_ID",
+  "GPG_PRIVATE_KEY",
+  "PAIRUX_PARTNERS"
  ]
 }
diff --git a/dev2/sites.d/postammo.com.json b/dev2/sites.d/postammo.com.json
index 86531e7..d86995d 100644
--- a/dev2/sites.d/postammo.com.json
+++ b/dev2/sites.d/postammo.com.json
@@ -11,5 +11,10 @@
   "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
   "SUPABASE_URL": "https://supabase.postammo.com",
   "SUPABASE_JWT_JWKS_URL": "https://supabase.postammo.com/auth/v1/.well-known/jwks.json"
- }
+ },
+ "vault_skip": [
+  "DOPPLER_CONFIG",
+  "DOPPLER_ENVIRONMENT",
+  "DOPPLER_PROJECT"
+ ]
 }
diff --git a/dev2/sites.d/qaaas.dev.json b/dev2/sites.d/qaaas.dev.json
index 985abc3..cd83fb8 100644
--- a/dev2/sites.d/qaaas.dev.json
+++ b/dev2/sites.d/qaaas.dev.json
@@ -15,5 +15,8 @@
   "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.qaaas.dev"
  },
  "node_heap_mb": 384,
- "mem_note": "next + worker + redis in one 1g container"
+ "mem_note": "next + worker + redis in one 1g container",
+ "vault_skip": [
+  "GITHUB_APP_PRIVATE_KEY"
+ ]
 }
diff --git a/dev2/sites.d/qrypt.chat.json b/dev2/sites.d/qrypt.chat.json
index a5b28f7..8cd489d 100644
--- a/dev2/sites.d/qrypt.chat.json
+++ b/dev2/sites.d/qrypt.chat.json
@@ -17,5 +17,8 @@
  },
  "keep_services": [
   "realtime"
+ ],
+ "vault_skip": [
+  "RIOTCODER_QC_PASSPHRASE"
  ]
 }
diff --git a/dev2/sites.d/r4ck.dev.json b/dev2/sites.d/r4ck.dev.json
index 6e8a3dc..369a567 100644
--- a/dev2/sites.d/r4ck.dev.json
+++ b/dev2/sites.d/r4ck.dev.json
@@ -4,5 +4,8 @@
  "redis": true,
  "env_overrides": {
   "REDIS_URL": "redis://redis:6379"
- }
+ },
+ "vault_skip": [
+  "NICHEDB_URL"
+ ]
 }
diff --git a/dev2/sites.d/ringhuman.com.json b/dev2/sites.d/ringhuman.com.json
index 119163a..6488471 100644
--- a/dev2/sites.d/ringhuman.com.json
+++ b/dev2/sites.d/ringhuman.com.json
@@ -7,5 +7,17 @@
  "redirect_to": {
   "default": "https://ringhuman.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "API_URL",
+  "APP_URL",
+  "GOOSE_DBSTRING",
+  "GOOSE_DRIVER",
+  "GOOSE_MIGRATION_DIR",
+  "MODEL_PROVIDER",
+  "NODE_ENV",
+  "PORT",
+  "REDIS_URL",
+  "RESEND_FROM_EMAIL"
+ ]
 }
diff --git a/dev2/sites.d/saasrow.com.json b/dev2/sites.d/saasrow.com.json
index 51032cb..bf3dde6 100644
--- a/dev2/sites.d/saasrow.com.json
+++ b/dev2/sites.d/saasrow.com.json
@@ -24,5 +24,15 @@
   "default": "https://saasrow.pwa.pit.world",
   "supabase.saasrow.com": "https://saasrow-supabase.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "ADMIN_EMAIL",
+  "GETSCREENSHOT_API_KEY",
+  "OPENAI_API_KEY",
+  "RESEND_API_KEY",
+  "RESEND_DOMAIN",
+  "SITE_URL",
+  "STRIPE_SECRET_KEY",
+  "STRIPE_WEBHOOK_SECRET"
+ ]
 }
diff --git a/dev2/sites.d/sh1pt.com.json b/dev2/sites.d/sh1pt.com.json
index 6534fa5..67b2458 100644
--- a/dev2/sites.d/sh1pt.com.json
+++ b/dev2/sites.d/sh1pt.com.json
@@ -10,5 +10,8 @@
   "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
   "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
   "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.sh1pt.com"
- }
+ },
+ "vault_skip": [
+  "ANTHROPIC_API_KEY"
+ ]
 }
diff --git a/dev2/sites.d/smshub.dev.json b/dev2/sites.d/smshub.dev.json
index e010078..0cd4f63 100644
--- a/dev2/sites.d/smshub.dev.json
+++ b/dev2/sites.d/smshub.dev.json
@@ -19,5 +19,10 @@
  "notes": "api.smshub.dev was the Railway-hosted Supabase gateway name; kept as an alias of supabase.smshub.dev so old clients keep working.",
  "keep_services": [
   "realtime"
+ ],
+ "vault_skip": [
+  "EXPO_TOKEN",
+  "SMSHUB_ALERT_API_KEY",
+  "SUPABASE_DB_PASSWORD"
  ]
 }
diff --git a/dev2/sites.d/threatcrush.com.json b/dev2/sites.d/threatcrush.com.json
index 8ccfaa5..9ac796c 100644
--- a/dev2/sites.d/threatcrush.com.json
+++ b/dev2/sites.d/threatcrush.com.json
@@ -14,5 +14,17 @@
  },
  "mem_limit": "1536m",
  "node_heap_mb": 0,
- "mem_note": "image sets NODE_OPTIONS=--max-old-space-size=1024"
+ "mem_note": "image sets NODE_OPTIONS=--max-old-space-size=1024",
+ "vault_skip": [
+  "ABUSEIPDB_API_KEY",
+  "ABUSEIPDB_EMAIL",
+  "ABUSEIPDB_PASSWORD",
+  "ABUSEIPDB_USERNAME",
+  "GITHUB_APP_PRIVATE_KEY",
+  "STOPFORUMSPAM_API_KEY",
+  "STOPFORUMSPAM_EMAIL",
+  "STOPFORUMSPAM_PASSWORD",
+  "STOPFORUMSPAM_USERNAME",
+  "THREATCRUSH_AGENT_KEY"
+ ]
 }
diff --git a/dev2/sites.d/tsbb.dev.json b/dev2/sites.d/tsbb.dev.json
index 33c6433..4c17b3d 100644
--- a/dev2/sites.d/tsbb.dev.json
+++ b/dev2/sites.d/tsbb.dev.json
@@ -6,5 +6,9 @@
  "redirect_to": {
   "default": "https://tsbb.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "SIRIUSXM",
+  "SIRIUSXM_PROXY_URL"
+ ]
 }
diff --git a/dev2/sites.d/typeheard.com.json b/dev2/sites.d/typeheard.com.json
index 13daf1f..3b97f00 100644
--- a/dev2/sites.d/typeheard.com.json
+++ b/dev2/sites.d/typeheard.com.json
@@ -42,5 +42,6 @@
  "redirect_to": {
   "default": "https://typeheard.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault": "typeheardcom--prod"
 }
diff --git a/dev2/sites.d/vu1nz.com.json b/dev2/sites.d/vu1nz.com.json
index 4bd2a39..0dfc499 100644
--- a/dev2/sites.d/vu1nz.com.json
+++ b/dev2/sites.d/vu1nz.com.json
@@ -1,4 +1,8 @@
 {
  "node_heap_mb": 512,
- "mem_note": "next + tsx worker in one container"
+ "mem_note": "next + tsx worker in one container",
+ "vault_skip": [
+  "CRAWLPROOF_WEBHOOK_SECRET",
+  "GITHUB_APP_PRIVATE_KEY"
+ ]
 }
diff --git a/dev2/sites.d/w3bs.org.json b/dev2/sites.d/w3bs.org.json
index ac5e0c6..ff099fa 100644
--- a/dev2/sites.d/w3bs.org.json
+++ b/dev2/sites.d/w3bs.org.json
@@ -14,5 +14,8 @@
       "port": 3342,
       "max_body": "100m"
     }
+  ],
+  "vault_skip": [
+    "W3BS_BRIDGE_CLIENTS"
   ]
 }
diff --git a/dev2/sites.d/weedforcrypto.com.json b/dev2/sites.d/weedforcrypto.com.json
index 685ecd3..cdc3949 100644
--- a/dev2/sites.d/weedforcrypto.com.json
+++ b/dev2/sites.d/weedforcrypto.com.json
@@ -18,5 +18,8 @@
   "default": "https://weedforcrypto.pwa.pit.world",
   "supabase.weedforcrypto.com": "https://weedforcrypto-supabase.pwa.pit.world"
  },
- "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses."
+ "redirect_note": "2026-11-08: domain retired; the app runs on as <name>.pwa.pit.world (dev2/edge/edge.json). This vhost only 308s there until the domain lapses.",
+ "vault_skip": [
+  "ADMIN_EMAILS"
+ ]
 }