Env Wrangler

Overview

Extract secrets from .env files into their own file (either .secrets or secrets.json). Also provides mask and unmask options. The resulting secrets file can be leveraged to get your secrets into a 3rd party secrets manager like AWS Secrets Manager or something else.

Plays nice with cookiecutter-django.

Installation

python3 -m pip install env-wrangler

Usage

The path parameter is a directory, not a file!

env-wrangler extract --path ".envs/.production"
# Only run if you've previously run extract
env-wrangler mask --path ".envs/.production"
env-wrangler unmask --path ".envs/.production"

NOTE: For help run env-wrangler --help or for a specific command run env-wrangler {command} --help.

On first run, env-wrangler creates ~/.env-wrangler/env-wrangler.toml. The default config section supports:

• key_words: substrings used to identify secret-like keys
• ignore_keys: exact keys to skip even if they match key_words
• envs: env files to scan (for example .env, .django, .postgres)

Development

just --list
just env
just pip-install-editable

Testing

just pytest
just coverage
just open-coverage

For quick local quality checks:

just check

Issues

If you experience any issues, please create one in the Bitbucket issue tracker.

History

All notable changes to this project will be documented in this file. This project adheres to Semantic Versioning.

0.1.7 (2026-04-22)

• Moved project tooling and packaging workflow to Hatch and xapp-tools.
• Improved automated test coverage, including CLI command coverage updates.
• Removed pkg_resources usage and moved resource loading to importlib.resources.

0.1.6 (2025-03-31)

• Fixed missing dependency and data file.

0.1.5 (2024-04-23)

• Moved from configparser to toml for configuration.

0.1.4 (2024-04-19)

• Bug fix when getting key from .env file for comparision

0.1.3 (2024-04-19)

• Added ignore_keys to config for keys (exact key names) to always ignore even if they contain key_word.

0.1.2 (2024-04-18)

• Bug fix for if a env value contains an "=". We only split on the first "=" so we get key,value from .env.

0.1.1 (2024-04-18)

• Write secrets files non-destructively
• Sort keys for secrets files

0.1.0 (2024-04-15)

• First release