🔐 EnvLockr CLI

Secure your environment variables — locally, encrypted, and stream-safe.

EnvLockr CLI is a tool for developers, streamers, and indie hackers who want full control of their secrets without relying on cloud services.

✨ Features

• Local-first: All secrets stored encrypted on your machine — no cloud, no account
• Keychain-backed key: The master key lives in your OS keychain (Windows Credential Manager / macOS Keychain / libsecret), not a plaintext file beside the vault — real protection if your disk is compromised
• run injection: envlockr run -- npm run dev injects secrets straight into the process — no .env ever written to disk
• Liveness verify: envlockr verify checks whether your stored keys are still live (Stripe, OpenAI, Anthropic, GitHub, Slack) — catch revoked/rotated keys
• Profiles: --env prod for isolated per-environment vaults
• Offline Mode: Core commands need no internet
• Stream-Safe: No .env on screen while coding or streaming
• Cross-Project Friendly: Works with React, Node.js, Python, and more
• GitHub Action: Scan commits for exposed secrets (Learn more)

🚀 Quick Start

1. Install

# Install from PyPI (recommended)
pip install envlockr

# Recommended: keychain-backed key + clipboard support
pip install "envlockr[keychain,clipboard]"

Using an npm-centric workflow? There's an npm wrapper so envlockr works in package.json scripts and with npx (it proxies to the Python CLI above):

npm install -g envlockr   # wrapper — still needs the pip package installed

💡 Without the keychain extra, the master key falls back to a 0600 file on disk and EnvLockr warns you. Install the extra for real disk-compromise protection, then run envlockr secure-key to migrate an existing key.

git clone https://github.com/RohanRatwani/envlockr-cli.git
cd envlockr-cli
pip install -e .

2. Commands

By default add prompts securely (hidden input). For scripts and CI, pass the value non-interactively:

envlockr add API_KEY --value "$API_KEY" --force      # from a variable
printf '%s' "$API_KEY" | envlockr add API_KEY --stdin # from stdin (no shell history)

⚡ How to Use in Your Projects

🖥 Node.js / React / Vite / Next.js

Option 1 (recommended): run — inject secrets, no file on disk

envlockr run -- npm run dev

All your secrets are injected into the process environment. Nothing is written to disk, so there is no .env to accidentally commit or leak on stream.

Option 2: Export to .env file

envlockr export --output .env
npm run dev

Option 3: Inline Injection of a single value

export STRIPE_KEY=$(envlockr get STRIPE_KEY)
npm run dev

Option 3: Import existing .env file

# Migrate your existing .env to encrypted storage
envlockr import .env
rm .env  # Delete the unencrypted file

🛠 Compatible with

• create-react-app
• Next.js
• Vite
• Remix
• Express
• NestJS
• and more!

👉 See framework-specific examples - React, Next.js, Python, Docker, and more!

📦 Local Storage & Security Model

Your secret values are encrypted with Fernet (AES-128-CBC + HMAC) and stored in:

~/.envlockr/vault.json        # encrypted secret values

The master key is stored in one of two places:

• OS keychain (when envlockr[keychain] is installed) — the key never touches the filesystem, so reading vault.json alone is useless to an attacker.
• ~/.envlockr/key.key (0600) as a fallback when no keychain is available. In this mode the key sits next to the vault, so disk access = full access — EnvLockr warns you and you can upgrade with envlockr secure-key.

For backups and team sharing, encrypt-vault bundles the vault + key behind a password using PBKDF2-HMAC-SHA256 (600k iterations) with a random per-file salt.

• ✅ No external cloud or server dependency
• ✅ Honest about where the key lives — no false "uncrackable" claims

🔍 GitHub Action - Prevent Secret Leaks

EnvLockr includes a GitHub Action that automatically scans your repository for exposed secrets!

Quick Setup

Add this to .github/workflows/envlockr-scan.yml:

name: EnvLockr Secret Scan
on: [pull_request, push]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan for secrets
        run: |
          curl -sSL https://raw.githubusercontent.com/RohanRatwani/envlockr-cli/main/.github/scripts/scan-secrets.sh | bash

What it does:

• ✅ Scans commits for API keys, tokens, and passwords
• ✅ Blocks PRs if secrets are detected
• ✅ Posts helpful comments with fix instructions
• ✅ Detects AWS, Stripe, GitHub, Google, OpenAI, and more

👉 Full GitHub Action Documentation

🆚 How EnvLockr is different

There are great tools in this space — EnvLockr fills the gaps they leave:

• vs dotenvx — dotenvx keeps the decryption key in a .env.keys file on disk; EnvLockr puts it in your OS keychain and can run your app with nothing written to disk.
• vs gitleaks/trufflehog — those are scanners, not managers. trufflehog can verify secrets it finds by scanning; EnvLockr's verify does that for the vault you actively manage — plus it gives you a place to put the secrets (and wraps gitleaks for scanning when present).
• vs SOPS/Vault — no KMS, no server, no YAML — one pip install and you're running.

💬 Why EnvLockr?

• 🔒 Protect your keys without trusting the cloud
• 🎥 Stream coding sessions without leaking environment secrets
• ⚡ Speed up local development with simple, fast secret management

📚 Documentation

• Quick Reference Guide - Common commands and workflows
• Framework Examples - React, Next.js, Python, Node.js, Docker
• GitHub Action Setup - Prevent secret leaks in CI/CD
• Contributing Guide - Help improve EnvLockr
• Changelog - Version history

📥 What's Next?

We're exploring new features for EnvLockr, including:

• Advanced environment injection (envlockr inject -- npm run dev)
• Desktop UI app
• IDE integrations (VS Code, JetBrains)

👉 Join the Waitlist and share your thoughts!

💡 We Want Your Feedback!

Which features would you love to see in EnvLockr?

• 💬 GitHub Discussions
• 🐛 Report Issues
• 🌟 Star us on GitHub

🛡️ License

This project is licensed under the MIT License.

Made with ❤️ by Rohan Ratwani
Website · GitHub · Twitter