🛡️ lockenv

Zero-config .env file encryption. Your secrets, version-controlled and safe.

🇺🇸 English • 🇷🇺 Русский • 🇨🇳 简体中文 • 🇪🇸 Español

Installation • Quick Start • Commands • How It Works • FAQ

---

The Problem

Every developer has done it:

git add .
git commit -m "quick fix"
git push
# 😱 You just pushed your DATABASE_URL with production passwords to GitHub

.env files contain secrets. Putting .env into .gitignore is standard, but:

• Sharing secrets is painful: Sending secrets via Slack/Telegram DMs is insecure and messy.
• Outdated configs: New teammates receive old .env files and waste hours debugging missing keys.
• No version history: Who updated STRIPE_KEY? When? What changed in staging vs prod?
• Accidental leaks still happen: One stray git commit and your secrets live in git history forever.

The Solution

lockenv encrypts your .env files using modern age cryptography so you can safely commit them to git alongside your code.

lockenv init    # One command to generate key, set up .gitignore & pre-commit hook
lockenv lock    # Encrypt .env → .env.locked (safe to commit to git)
lockenv unlock  # Decrypt .env.locked → .env (after git pull)

No cloud account. No SaaS subscription. No GPG complexity. Just simple, offline encryption.

---

📦 Installation

From Cargo (recommended)

cargo install lockenv

From Source

git clone https://github.com/FLURI3/lockenv.git
cd lockenv
cargo install --path .

Pre-built Binaries

Download standalone binaries from GitHub Releases for:

• Linux (x86_64, aarch64)
• macOS (Apple Silicon / Intel)
• Windows (x86_64)

---

🚀 Quick Start

1. Initialize in your project

cd your-project
lockenv init

This will automatically:

• 🔑 Generate an encryption key (.lockenv/key)
• 📄 Add .env and .lockenv/key to .gitignore
• 🛡️ Install a Git pre-commit hook (physically blocks committing unencrypted .env files)
• 🔒 Encrypt any existing .env file into .env.locked

2. Daily Workflow

# After modifying secrets in .env:
lockenv lock

# Commit the encrypted file safely:
git add .env.locked
git commit -m "update staging credentials"
git push

# Teammates pull and unlock:
git pull
lockenv unlock

3. Share Key with Your Team

Share .lockenv/key once through a secure channel (1Password, Bitwarden, encrypted message):

# Team member clones the repo and adds key:
git clone <repo>
echo "PASTE_KEY_HERE" > .lockenv/key
lockenv unlock

---

📖 Commands

lockenv init

Initialize lockenv in the current directory.

lockenv init

lockenv lock [file]

Encrypt .env into .env.locked.

lockenv lock              # Encrypts .env -> .env.locked
lockenv lock .env.staging # Encrypts .env.staging -> .env.staging.locked

lockenv unlock [file]

Decrypt .env.locked into .env.

lockenv unlock                     # Decrypts .env.locked -> .env
lockenv unlock .env.staging.locked # Decrypts .env.staging.locked -> .env.staging

lockenv diff <file_a> <file_b>

Compare keys between two environment files without leaking secrets.

lockenv diff .env .env.staging

  Comparing .env and .env.staging
  ────────────────────────────────
  ~ API_KEY             (changed value)
  ~ DATABASE_URL        (changed value)
  - DEBUG               (only in .env)
  = PORT                (same value)
  + REDIS_URL           (only in .env.staging)

  ℹ Summary: 1 unchanged, 2 changed, 1 added, 1 removed

lockenv example

Generate a .env.example file automatically with stripped secret values.

lockenv example
lockenv example --file .env --output .env.template

lockenv audit

Scan your entire Git history for leaked .env files committed in the past.

lockenv audit

lockenv edit [file]

Decrypt into memory, open in $EDITOR / Notepad, and re-encrypt automatically upon saving.

lockenv edit
EDITOR=nano lockenv edit

---

🔧 How It Works

• Cryptography: Uses the age encryption format (X25519, ChaCha20-Poly1305).
• Format: ASCII Armor (-----BEGIN AGE ENCRYPTED FILE-----) for clean Git text diffs.
• Git Guardian: Pre-commit hook prevents human error before commits happen.

your-project/
├── .env              ← Plaintext secrets (Ignored by Git)
├── .env.locked       ← Encrypted secrets (Committed to Git)
├── .env.example      ← Template file (Committed to Git)
└── .lockenv/
    ├── config.toml   ← Settings (Committed to Git)
    └── key           ← Encryption key (Ignored by Git)

---

⚔️ Comparison

Feature	lockenv	git-crypt	SOPS	HashiCorp Vault
Zero-Config Setup	✅ lockenv init	❌ GPG required	❌ Cloud KMS / Age setup	❌ Server setup
Tailored for .env	✅ Built-in	❌ Generic	❌ Generic	❌ API-based
Automatic Git Hook	✅ Automatic	❌ Manual	❌ Manual	❌ N/A
Env Key Diffing	✅ lockenv diff	❌ No	❌ No	❌ No
Template Generator	✅ lockenv example	❌ No	❌ No	❌ No
Single Binary	✅ Rust (No runtime)	❌ Needs GPG	❌ Needs KMS / CLI	❌ Daemon / Client

---

🤝 Contributing

Contributions are welcome! Feel free to open an Issue or submit a Pull Request.

git clone https://github.com/FLURI3/lockenv.git
cd lockenv
cargo test

📄 License

MIT © lockenv contributors