enveil: What It Kills
Enveil murders plaintext environment variable files like dotenv, which dump secrets into readable .env files that any nosy process—or worse, AI code assistants—can slurp up. No more accidental leaks from git commits or AI training data scrapes. It kills the naive habit of treating local dev machines like production servers with Vault, forcing you to confront that most secrets start local and die there from stupidity.
Under the Hood
At its core, enveil encrypts secrets using AES-256-GCM, a symmetric cipher that's battle-tested and not some half-baked homebrew. Passwords derive keys via Argon2id, which resists GPU cracking better than PBKDF2 ever dreamed. Secrets live in an encrypted local store—no plaintext anywhere.
The magic is the ev:// protocol: reference secrets in your code or commands as ev://my-api-key, and enveil resolves them at runtime, injecting values directly into subprocess memory. No files, no env exports, no disk traces. Run enveil run -- cargo test, and it spawns your binary with decrypted secrets fed via env vars or args, wiped after. The master password unlocks the store; derive it wrong, and you're locked out. Simple, local, no network calls.
Architecture stays lean: Rust binary manages the store, CLI handles ops like enveil store add or enveil run. Cargo integration means it slots into Rust workflows without drama.
The Good & The Bad
Pros:
- AES-256-GCM and Argon2id: crypto you can trust, not vaporware.
- Blocks AI tools (Copilot, Cursor) from hoovering secrets off disk—your LLM won't accidentally train on your Stripe keys.
- Fits Rust devs using Cargo: install once, run everywhere local.
- Zero network dependency: secrets never leave your machine.
Cons:
- Password prompts every session: fine for dev laptops, hell for unattended scripts or CI/CD.
- Master password is king: forget it, secrets gone forever—no recovery without backups.
- Local only: scale to teams? Everyone silos their store, coordination nightmare.
- Subprocess injection limits: works for shells and Cargo, but finicky with Docker or exotic runtimes.
Quickstart
# Install enveil using cargo
cargo install enveil
# Store a secret
enveil store add API_KEY
# Paste or pipe your value, enter master password
# Run with secrets injected
enveil run -- npm start
# Or for Rust: enveil run -- cargo run
Who Should Use This (and Who Shouldn't)
Use enveil if you're a solo dev or small team juggling local secrets on dev machines—API keys, DB creds, tokens that shouldn't hit git or AI scrapers. Rust/Cargo users get seamless install and runtime integration; if your workflow is cargo run with env needs, this slots in without rewriting apps. Paranoid about AI tools reading your .env? Perfect antidote. Local-only focus shines for prototyping where prod Vault feels like overkill.
Skip it if you're in heavy CI/CD: password prompts kill automation—use Vault or cloud secrets there. Teams needing shared secrets across machines? Enveil's per-user stores create sync hell; pick SOPS or HashiCorp Vault. Non-Rust stacks? Installation works, but Cargo bias makes it clunky. If you forget passwords often or hate local state, look elsewhere—data loss waits for no one.
Alternatives & When to Switch
dotenv: Zero setup, just npm i dotenv. Dumps secrets to plaintext .env—idiot-proof until you git commit or AI indexes it. Switch to enveil when leaks bite; dotenv wins for throwaway scripts where security is a joke.
SOPS (Secrets OPerationS): Encrypts YAML/JSON files with age or KMS. Great for git-committable configs, team sharing via PGP. But runtime? You decrypt manually—no auto-injection like enveil. Switch from enveil if you need versioned, shared secrets over local silos; SOPS loses on dev convenience.
HashiCorp Vault: Enterprise beast for dynamic secrets, leases, ACLs. Audits everything, scales to prod. Overkill for local dev—auth flows, servers, ops tax. Enveil for quick local; Vault when compliance demands it or teams >10. Trade-off: Vault's complexity vs enveil's "it just works" until it doesn't.
1Password CLI / Bitwarden: Password managers with env export. Convenience for humans, but scripted access exposes tokens. Enveil tighter for app subprocesses. Switch if you already pay for PW managers and hate new tools.
Ruthless pick: enveil for solo Rust local dev fearing AI leaks. Grow a team? SOPS. Prod-scale? Vault. Stay small and secure, or scale and suffer.
