Every team has done it. Someone needs the staging login, or the client’s API key, or the FTP password, so it gets pasted into a Slack channel. It works, the moment passes, and the secret stays there forever, searchable, sitting in a chat history that half the company can scroll back through.
The problem is not that people are careless. It is that there is usually nowhere sensible to put a secret. It belongs with a particular piece of work, but the task manager has no safe field for it, so it lands wherever the conversation is happening instead.
Coalface Tasks has that field. It is called the Vault.
A secret should live with the task
When you are working on a client’s site, the login for that site belongs with that work, not in a separate password manager you have to go and find, and definitely not in a chat thread.
The Vault lets you attach a hidden, protected value straight to a task. The staging password sits on the staging task. The API key sits on the integration task. When someone picks the work up, the thing they need is right there, and it is not floating around anywhere else.
What makes it different from just typing it in a note
A normal note is convenient, but it travels. It can sync to your WordPress site, get sent to Slack, show up in search, or be included in an export. That is exactly what you do not want a password to do.
A Vault value does none of that. By design, it is:
- never synced to WordPress,
- never sent to Slack, webhooks or AI,
- never included in search or export.
It simply stays inside Coalface Tasks, encrypted, and shows only when someone who is allowed to see it chooses to reveal it. There is no path by which it quietly leaks somewhere else, because we did not build one.
Locking it down to the people who should see it
By default, anyone with access to a board can use its Vault. For a lot of teams that is fine.
But if you would rather keep secrets to a smaller circle, you can switch on managers-only mode. Then only owners, admins and managers can reveal or set a Vault value. Everyone else does not just get refused, they do not even see the field. The secret is invisible to the people who have no business seeing it.
Where the rest of your data sits
The Vault is the strict end of a wider approach. Underneath it, Coalface Tasks encrypts your task descriptions, comments and subtasks at rest by default, so your everyday content is protected without you thinking about it. The Vault is for the small number of things that should be held even more tightly than that, and never leave the app at all.
We are careful about how we describe this. Coalface can still decrypt your content to do useful things for you, so it is not end-to-end encryption and we never call it that. But a Vault value is genuinely walled off from every route out of the app, and that is the promise that matters when it is a client’s password on the line.
The short version
- Secrets end up in Slack because there is usually nowhere better to put them.
- The Vault attaches a protected value directly to the task it belongs to.
- A Vault value is never synced, sent, searched or exported. It only shows when someone allowed to see it reveals it.
- Turn on managers-only mode to hide secrets from everyone but your managers.
Your client’s password does not belong in a chat channel. Put it on the task, in the Vault, and let it stay there.