🌸 envware

Securely sync encrypted secrets across your devices and team.

Envware is a CLI tool designed to simplify environment variable management with a focus on security, privacy, and developer experience.

Why Envware?

Stop sharing .env files via Slack, DMs, or insecure notes. Envware ensures your secrets never touch the cloud in plain text.

• 🔒 Zero-Trust Architecture: Built on a decentralized trust model. Your secrets are encrypted locally using AES-256-GCM. We never see your data.
• 🔑 SSH Identity: Authorization is tied to your existing SSH keys. No complex setup, no passwords to leak.
• 🏢 Multi-tenant Teams: Organize projects by teams with granular access control.
• 🛡️ Secure Key Exchange: Access is granted by encrypting a Project Key directly for a user's verified public key. No intermediate codes.
• ✨ Verification via Fingerprint: Verify collaborator identities using SHA256 fingerprints, making it immune to server-side tampering.

Quick Start

1. Installation

Run directly with npx:

npx envware login

2. Create or Select a Project

npx envware project create my-awesome-api

3. Push and Pull Secrets

# Upload your local .env (encrypted locally first!)
npx envware push

# On another machine, download and decrypt
npx envware pull

Security Model (How it works)

Envware uses a dual-key E2EE system:

1. User Identity: Derived from your local SSH public key.
2. Project Key: A unique AES-256 key generated for each project.
3. Storage: The server only stores "encrypted blobs". The Project Key is stored encrypted with your SSH Public Key.

Verification Flow

To ensure absolute security even if the database is compromised:

1. A collaborator requests access: envw request team/project.
2. They share their unique identity: envw fingerprint.
3. The owner approves the request: envw approve.
4. The owner verifies the fingerprint displayed on their screen matches the collaborator's identity before the CLI encrypts the key.

Result: Mathematical certainty that secrets only open for authorized devices.

Core Commands

• signup: Create a new account and your default team.
• project: Manage projects (create, list, select).
• team: Manage teams (create, list).
• request <team/project>: Request access to a project.
• approve: Approve pending requests (Owner/Admin only).
• sync-access: Sync all your approved accesses.
• fingerprint: Show your device SHA256 identity.
• keys: Manage your authorized SSH keys.
• status: Check your plan, team, and usage.

Website: https://www.envware.dev
Documentation: https://www.envware.dev/docs
GitHub: https://github.com/envware/cli 🌸