vaultenv

Encrypted .env vault — commit secrets safely to git.

AES-256-GCM encryption. scrypt key derivation. Zero runtime dependencies.

Install

npm install vaultenv

How it works

Your .env ──seal(passphrase)──► .env.vault  ← safe to commit
                                     │
              runtime: open(passphrase) → { DB_URL, API_KEY, ... }

Usage

import { seal, open, load } from 'vaultenv';

// Seal (encrypt) — run once to create the vault
seal(
  { DB_URL: 'postgres://...', API_KEY: 'sk-...' },
  process.env.VAULT_KEY!
);
// Writes .env.vault — commit this file to git

// At runtime — decrypt and inject into process.env
load(process.env.VAULT_KEY!);
console.log(process.env.DB_URL); // postgres://...

Security

| Property | Detail | |----------|--------| | Cipher | AES-256-GCM (authenticated encryption) | | KDF | scrypt (N=32768, r=8, p=1) | | Salt | 16 random bytes per seal | | IV | 12 random bytes per seal | | Tamper detection | GCM auth tag |

License

MIT © trysentinelagent