\n\n\n\n\n# envy\n\n### Encrypted secrets, zero friction.\n\n**Local-first secret management for teams who take security seriously.**\nNo SaaS. No internet. No plaintext — ever.\n\n[](https://github.com/anguriatech/envy/actions/workflows/ci.yml)\n[](https://github.com/anguriatech/envy/releases/latest)\n[](LICENSE)\n\n```bash\nbrew install anguriatech/tap/envy\n```\n\n```bash\nnpm install -g @anguriatech/envy\n```\n\n
\n\n---\n\n\n\n| \n\n### 🔐 Zero-Trust Storage\n\nSecrets are encrypted with AES-256-GCM before they touch the database. The database itself is encrypted with SQLCipher. The master key lives exclusively in your OS Keychain — never written to any file, never exposed to the filesystem.\n\nStealing your `~/.envy/vault.db` gets an attacker nothing without the OS credential entry. Stealing your OS credential entry gets them nothing without the encrypted database. **Defense in depth, not defense by hope.**\n\n | \n\n\n### 🧠 Memory-Safe Secret Injection\n\n`envy run -- your-app` decrypts secrets in RAM and passes them to your process via `std::process::Command::envs()`. When the process exits, the memory is zeroed. Nothing is written to disk, shell history, or environment exports.\n\nAll secret values are wrapped in Rust's `Zeroizing` — backing memory is overwritten to zero on drop, even if the program panics.\n\n | \n
\n\n| \n\n### 🌿 GitOps-Native\n\n`envy encrypt` produces `envy.enc` — a single JSON file sealed with Argon2id + AES-256-GCM. It contains **no key names, no values, no project identifiers**. Commit it to your public repo. Post it on Twitter. It is pure ciphertext.\n\n`envy decrypt` on any machine restores your vault from the artifact. Onboarding a new team member is a `git pull` and one passphrase.\n\n | \n\n\n### 🔬 Pre-Encrypt Audit Trail\n\n`envy diff` shows exactly what will change before you seal — additions, deletions, and modifications — with `diff(1)` exit codes for CI/CD gating. Values are hidden by default. `--reveal` requires explicit opt-in with a stderr warning.\n\nKnow exactly what you're committing to the artifact before you commit it.\n\n | \n
\n\n| \n\n### 🏢 Multi-Team Progressive Disclosure\n\nSeal `development`, `staging`, and `production` with separate passphrases. A developer with the dev key imports their environment; `production` is listed as skipped — **not an error, not a prompt, not an alarm**. Access follows the passphrase, not a permissions UI.\n\n | \n\n\n### 🤖 CI/CD Native, Zero Config\n\nSet `ENVY_PASSPHRASE_` in your pipeline's secret store. Envy detects it and goes fully headless — no TTY, no prompts, no code changes required. Works with GitHub Actions, GitLab CI, CircleCI, Jenkins, and any shell that supports environment variables.\n\n | \n
\n
\n\n> **SOC 2 / Compliance note**: Envy eliminates the most common source of secret leakage — plaintext `.env` files in version control, chat logs, and build artifacts. It does not replace a full secrets management platform for regulated workloads, but it is a substantial step toward auditability: every secret change is a vault write, every seal is a committed `envy.enc` diff.\n\n---\n\n## Quickstart\n\n**Step 1 — Install and initialise**\n\n```bash\n# Homebrew (macOS & Linux)\nbrew install anguriatech/tap/envy\n\n# NPM (all platforms)\nnpm install -g @anguriatech/envy\n```\n\n> Windows, curl, or build-from-source? See the [Installation](#installation) section below.\n\n```bash\ncd my-project\nenvy init # creates envy.toml (safe to commit)\n```\n\n**Step 2 — Store secrets and run your app**\n\n```bash\nenvy set DATABASE_URL=postgres://localhost/myapp\nenvy set API_KEY=sk_live_abc123\n\nenvy run -- npm run dev\n# secrets injected into the child process, never written to disk\n```\n\n**Step 3 — Seal and share with your team**\n\n```bash\n# Preview what you're about to commit\nenvy diff\n# + API_KEY\n# + DATABASE_URL\n# 2 changes: 2 added, 0 removed, 0 modified\n\nenvy encrypt # prompts for a passphrase (or set ENVY_PASSPHRASE in CI)\n\ngit add envy.enc envy.toml\ngit commit -m \"chore: add encrypted secrets\"\ngit push\n```\n\nA teammate pulls the repo and runs `envy decrypt`. Done. No Slack messages, no shared spreadsheets, no plaintext ever leaving your encrypted vault.\n\n### Interactive TUI\n\n![\"Envy](\"docs/assets/demo.gif\")
\n![\"Envy](\"docs/assets/tui-demo.gif\")
\n