crowenv 1.0.1

CrowEnv — Smart secrets. Like a crow. 🐦‍⬛ Python loader for the .cenv encrypted secrets standard (AES-256-GCM)

🐦‍⬛ CrowEnv — Python

CrowEnv replaces insecure plain .env files with .cenv — AES-256-GCM encrypted secrets safe to commit to Git.

"Crows hide their treasures. Now so can you." 🐦‍⬛

Install

pip install crowenv

Quick Start

# 1. Initialize .gitignore
crowenv init

# 2. Generate a 256-bit master key (save this in your secrets manager!)
crowenv generate-key
# 🔑 a3f8c901... ← copy and store safely

# 3. Set the key
export CENV_MASTER_KEY="a3f8c901..."

# 4. Encrypt your .env
crowenv encrypt
# ✅ .cenv created (3 secrets, AES-256-GCM)

# 5. Commit .cenv safely
rm .env && git add .cenv && git commit -m "Add encrypted secrets"

Python API

import cenv
import os

# Load .cenv into os.environ (call at app startup)
cenv.load()

# Now use secrets normally
db_password = os.getenv("DB_PASSWORD")
api_key = os.getenv("API_KEY")

CLI Commands

Command	Description
crowenv init	Initialize .gitignore
crowenv generate-key	Generate a 256-bit random master key
crowenv encrypt [file]	Encrypt .env → .cenv
crowenv decrypt [file]	Decrypt .cenv → stdout
crowenv load [file]	Load .cenv into process environment
crowenv verify [file]	Verify .cenv integrity

Security

Property	Value
Encryption	AES-256-GCM
Key derivation	PBKDF2-HMAC-SHA256 (600,000 iterations)
Nonce	12 bytes, random per encrypt
Auth tag	16 bytes (tamper detection built-in)
Dependency	cryptography library

The .cenv file format is git-safe — commit it openly. The master key stays secret (env var, secrets manager, vault).

The .cenv Format

{
  "v": "1.0",
  "s": "<base64 16-byte salt>",
  "d": "<base64 nonce(12) + auth_tag(16) + ciphertext>"
}

Links

• 🐦‍⬛ GitHub
• 📋 Full Spec
• 🔐 Security Policy
• 📦 npm (Node.js)
• 🦀 crates.io (Rust)

License

MIT