SecureDefaults — Encrypted Preferences

Overview

SecureDefaults is Yukkai's encrypted replacement for standard user preferences storage. Instead of saving settings, tokens, and configuration values in plain text on disk — where any process or user with file-system access could read them — SecureDefaults transparently encrypts every value with AES-256-GCM authenticated encryption before it is written to disk.

This means that even if an attacker gains access to your preference files, they will only see ciphertext — never your actual data.

How it works

SecureDefaults wraps the standard preferences layer with a transparent encryption pipeline:

1. Write path — When Yukkai saves a preference (e.g. a setting, a token, a configuration flag), the value is serialized and encrypted in memory using AES-256-GCM before being persisted to disk.
2. Read path — When a preference is read back, the ciphertext is loaded from disk, decrypted in memory, and returned to the application as the original value.
3. Key management — The encryption key is assembled at runtime from fragments distributed across multiple files in the app bundle, making trivial extraction from the binary extremely difficult. This mirrors the approach used to protect Yukkai's internal knowledge base.
4. Authenticated encryption — AES-256-GCM doesn't just encrypt; it also authenticates the data. Any tampering with the ciphertext on disk is detected automatically, and the corrupted value is rejected rather than silently loaded.

This is the same cryptographic standard used by Yukkai's Vault Encryption system (folder-level encryption), applied at the preferences layer.

How to use it

SecureDefaults operates transparently — you don't need to call any special commands or configure anything manually.

• When you change a setting in Yukkai's UI (preferences pane, toggles, configuration), the value is automatically encrypted before being saved.
• When Yukkai launches, preferences are decrypted in memory on demand.
• No plain-text preference files are ever written to disk.

You can verify that your preferences are encrypted by inspecting the preference files on disk — you will see only ciphertext, not readable values.

Examples

What a plain-text preference looks like (without SecureDefaults)

# Standard UserDefaults — readable by anyone with file access
lastUsedModel = "gpt-4o"
apiEndpoint = "https://api.openai.com/v1"
userToken = "sk-xxxxxxxxxxxx"

What SecureDefaults stores on disk

# Encrypted — unreadable without the key
lastUsedModel = "9f2a8b3c7e1d4f6a..."
apiEndpoint = "c1b2a3d4e5f6..."
userToken = "e7d8c9b0a1f2..."

The actual values are only ever present in memory, and only for as long as needed.

Tips & best practices

• No configuration needed — SecureDefaults is enabled by default for all sensitive preferences. There is no toggle to turn it off, by design.
• Backups are still encrypted — If you back up your Yukkai data directory (e.g. via Time Machine), the preference files remain encrypted. This is safe — no plain-text data leaks through backups.
• Don't manually edit preference files — Since values are encrypted, editing them directly will corrupt the ciphertext and cause the value to be rejected on next read. Always change settings through Yukkai's UI.
• Reinstalling is safe — After a clean reinstall, Yukkai reassembles the encryption key from the app bundle and can read previously saved encrypted preferences (as long as the app version is compatible).
• Sensitive secrets use the Vault — For high-value secrets like API keys, Yukkai uses the macOS Keychain via the Vault tool instead of preferences. SecureDefaults protects the preference layer; the Vault protects the secrets layer. Both layers use encryption, but they serve different purposes.

Layer	What it protects	Encryption
SecureDefaults	App preferences, settings, config flags	AES-256-GCM on disk
Vault (Keychain)	API keys, tokens, credentials	macOS Keychain + placeholder injection
Vault Encryption	Folders and files you encrypt manually	AES-256-GCM + BIP-39 + TouchID

For encrypting entire folders of sensitive documents, see Vault Encryption.