What the screen can claim
What is in GitHub lists the keys this connection carries and what the repository holds, and puts each one in a state. What can be said depends on which half of GitHub’s page the key lands in, and the difference is absolute: a secret’s value is not readable by anybody, and a variable’s is.
For a secret
Four states, and there is no fifth meaning the two sides agree, because no such fact is available to anybody.
| State | Means | What to do |
|---|---|---|
| Written by Kyvlt | kyvlt.sh wrote this secret, and nothing has edited it in GitHub since. | Nothing. |
| Not in GitHub yet | The key travels under this connection and no secret of that name exists. | Nothing — the next push creates it. |
| Changed in GitHub | Somebody edited it in GitHub after kyvlt.sh last wrote it. | Decide which side is right. The next push from kyvlt.sh overwrites it. |
| In GitHub, not pushed from here | A secret of that name exists that kyvlt.sh does not manage. | Nothing is done to it, ever. Remove it in GitHub if it is stale. |
“Changed in GitHub” is about a timestamp, not a value
It compares when kyvlt.sh last wrote against the updated_at GitHub reports.
Somebody may have pasted the identical string; the values may be the same. The
state says an edit happened there, which is all the timestamps support, and
deliberately not that the two sides now differ.
The reverse is also worth saying plainly: Written by Kyvlt does not mean the values match either. It means kyvlt.sh wrote it and nothing has edited it since. If the key in kyvlt.sh changed a second ago, the push for it may still be owed.
Why there is no tick beside a secret
A green tick next to a secret would be a claim that the secret in GitHub is the value in kyvlt.sh. Nothing can establish that. GitHub returns a name and two timestamps; the value is not readable by the API, by kyvlt.sh, or by you.
So the registry shows what is genuinely known — failing, waiting, or last pushed at a time — and the strongest word available anywhere in this feature is pushed.
Removing a key
Delete a key from kyvlt.sh, or file it out of a collection a narrowed connection carries, and the secret in GitHub becomes In GitHub, not pushed from here. It is not deleted and never will be by kyvlt.sh.
That is deliberate. Deleting a secret is a change to a repository that somebody else’s workflows depend on, and it fails at the next run with a message about an empty variable that says nothing about where it went.