secure-env-vault-cli

CLI for encrypting, decrypting, and managing .env vault files.

Install

npm install -g secure-env-vault-cli
# or
yarn global add secure-env-vault-cli

• bin/: CLI entry points
• src/: Command implementations and utilities

Commands

Encrypt

npx secure-env enc .env .env.vault <password>

Encrypts a .env file to a .env.vault file using PBKDF2 and AES.

Decrypt

npx secure-env dec .env.vault .env <password>

Decrypts a .env.vault file to a .env file.

Load

npx secure-env load .env.vault <password>

Prints export statements for secrets in a .env.vault file.

• Auto-detection: If you omit the vault file path, the CLI will look for .env.vault in the current directory by default.

Rotate Key

npx secure-env rot .env.vault <oldPassword> <newPassword> .env.vault.new

Re-encrypts a vault with a new password and salt. Use this if you need to change your password or rotate keys for security.

Why rotate keys?

• If a password is ever compromised, you can re-encrypt your secrets with a new password and salt.
• Regular key rotation is a security best practice.

Scan

npx secure-env scan src

Scans source files for risky secret usage (logging, alerts, etc).