/ANGURIA_

Envy

Zero-trust, encrypted secret management CLI built in Rust. No SaaS, no internet, no plaintext.

Rust
MIT
AES-256-GCM
Argon2id
SQLCipher
GitHub

Quickstart

envy — zsh
$envy init
✓ Initialized vault (local-first)
$envy set DATABASE_URL=postgres://localhost/app
✓ DATABASE_URL stored
$envy set API_KEY=sk_live_abc123
✓ API_KEY stored
$envy run -- npm run dev
↳ Injecting 2 secrets...
✓ Server running on :3000

GitOps workflow

envy — zsh
$envy diff
+ API_KEY
+ DATABASE_URL
2 changes pending seal
$envy encrypt
Passphrase: ········
✓ Sealed → envy.enc
$git add envy.enc && git commit -m 'secrets'
✓ Safe to push publicly

CI/CD — GitHub Actions

envy — zsh
$envy decrypt
✓ production (6 secrets upserted)
⚠ staging skipped — different passphrase
$envy diff -e production
✓ Artifact matches vault · exit 0
$envy run -e production -- ./deploy.sh
✓ Deploy complete
AES-256-GCM encryption

Every secret encrypted with a fresh nonce before touching the database. Master key lives in your OS Keychain — never on disk.

Zero-trust storage

Secrets are decrypted in RAM only. Memory is zeroed on drop. No plaintext ever reaches the filesystem.

GitOps-native

Produces a single sealed envy.enc file (pure ciphertext) you can safely commit publicly.

Multi-team access

Separate passphrases per environment. Partial access never triggers errors — junior devs get dev keys, prod stays restricted.

CI/CD ready

Headless mode via ENVY_PASSPHRASE_<ENV> env var. Works with GitHub Actions, GitLab CI, any pipeline.

Built in Rust

Memory-safe by design. Argon2id key derivation. Constant-time base64. No unsafe dependencies.

anguriatech/envy
Details
LanguageRust 1.85+
LicenseMIT
EncryptionAES-256-GCM
KDFArgon2id
StorageSQLCipher
StatusActive
Install