SecEnvVault CLI & Node.js SDK

Zero-Knowledge .env & secret orchestration CLI and SDK for developers, teams, and CI/CD pipelines.

SecEnvVault eliminates plaintext .env files floating across developer machines and Slack threads. Secrets are injected directly into child process memory with zero disk writes.

⚡ Instant Execution (Zero Install)

Run commands with your remote project secrets injected on the fly:

npx secenvvault run -- npm start
# or with specific environment:
npx secenvvault run -e production -- npm start

📦 Global Installation

Installing globally configures both secenvvault and the Git-like shorthand sev on your terminal PATH:

npm install -g secenvvault

🚀 Quickstart Workflow

1. Authenticate

sev login <YOUR_TOKEN>

2. Link your Project

sev init

(Creates a .secenv.json configuration file containing project IDs only — zero secrets).

3. Run with In-Memory Secrets (The Killer Command)

sev run -e production -- npm start
sev run -e development -- node server.js

Plaintext secrets never touch disk storage or temporary files.

4. Secret Operations

# List variables (values masked)
sev secret list

# Retrieve secret
sev secret get DATABASE_URL --reveal

# Set variable
sev secret set STRIPE_KEY "sk_live_..."

# Delete variable
sev secret delete OLD_KEY

5. Multi-Environment Parity & Drift Detector

# Compare environments side-by-side
sev env diff development production

6. 1-Click Ephemeral Self-Destructing Share Links

sev share STRIPE_KEY --expires 1h --max 1

💻 Node.js / TypeScript SDK

Install locally into your application:

npm install secenvvault

Automatic process.env Injection at Server Startup:

import { loadSecrets } from "secenvvault";

// Loads secrets into process.env before app initializes:
await loadSecrets({ environment: "production" });

console.log(process.env.DATABASE_URL);

Scoped Sandbox Execution:

import { withSecrets } from "secenvvault";

// Temporarily injects secrets, then restores previous environment:
await withSecrets({ environment: "staging" }, async () => {
  await runDatabaseMigrations();
});

🛡️ Security Architecture

• Zero-Knowledge Architecture: The server never sees your unencrypted plaintext keys.
• In-Memory Injection: Process variables are passed directly to child_process.spawn.
• Signal Forwarding: Dev servers handle SIGINT (Ctrl+C) and SIGTERM gracefully.
• Local Offline Cache: Optional 24-hour AES-256-GCM encrypted cache (sev run --cache).

📄 License

MIT © SecEnvVault