Zero-config secret injection. E2E encrypted. Sub-millisecond overhead. Replace scattered .env files with a single encrypted vault that injects secrets at runtime.
Initialize, vault your secrets, run your app. No config files. No environment juggling. No leaks.
Every feature exists to remove friction. Because the most secure workflow is the one developers actually use.
zenv run -- npm start replaces your entire .env workflow. True exec() on Unix means zero overhead after injection — zenv's memory is freed the instant your process starts.
ChaCha20-Poly1305 with HKDF-SHA256 key derivation. Per-secret AAD prevents ciphertext substitution attacks. The OS keychain is the trust anchor — the server never touches plaintext.
zenv scan walks your codebase detecting leaked credentials via vendor prefix matching, Shannon entropy analysis, and keyword heuristics. Catch leaks before they ship.
Automatic secret loading on directory change for bash, zsh, and fish. Secrets appear when you cd into a project and vanish when you leave. Zero manual steps.
Push secrets to Vercel, GitHub Actions, or AWS Secrets Manager with a single command. Diff before you push — see exactly what changes before anything goes live.
AWS STS, Stripe restricted keys — automatically issued, renewed, and revoked. Secrets that expire can't be leaked usefully. Never touch a static credential again.
From early-stage startups to scaling platforms — here's how teams eliminated secret sprawl with zenv.
Install the binary. Initialize your project. Import your .env. Your existing workflow doesn't change — it just gets encrypted.
Open source. MIT licensed. Built with Rust.