ENVeil: Hide .env secrets from prAIng eyes: secrets live in local encrypted stores (per project) and are injected directly into apps at runtime, never touching disk as plaintext. - GreatScott/enveil

Hacker News is a community-driven platform for sharing and discussing technology news, startups, and programming-related topics. Through user submissions and comments, Hacker News offers insights into emerging technology trends, industry developments, and entrepreneurial ventures. Readers can participate in discussions, share their insights, and stay informed about the latest advancements in technology and innovation.

Hacker News

enveil is a Rust CLI tool that protects .env secrets from AI coding tools (Claude Code, Copilot, Cursor, etc.) that can read project files. Instead of storing secrets as plaintext, it uses symbolic `ev://` references in .env files while keeping real values in a per-project encrypted local store (AES-256-GCM with Argon2id key derivation). Secrets are injected directly into subprocess environments at runtime, never written to disk as plaintext. The tool includes commands for initializing stores, adding/deleting secrets, rotating passwords, and importing existing .env files, with 31 automated tests verifying security invariants like nonce freshness, tamper detection, and wrong-password rejection.

GreatScott/enveil: ENVeil: Hide .env secrets from prAIng eyes: secrets live in local encrypted stores (per project) and are injected directly into apps at runtime, never touching disk as plaintext.

<p>It seems I had the same idea, but with a different approach. I use Go, with a Git hook to prevent commits containing secrets, and with a self-hosted repository so development teams can share secrets in real time. I’d like to hear your suggestions and improvements. I hope you see potential in it.</p>
<p><a href="https://github.com/MaximoCoder/Enveil" target="_blank" rel="noopener nofollow">https://github.com/MaximoCoder/Enveil</a></p>
