Dotenvx
dotenvx is an open-source upgrade to the standard .env file workflow, created by the original author of the dotenv package. The project is available at github.com/dotenvx/dotenvx, has approximately 5,500 GitHub stars, and was last updated in May 2026. It is written in JavaScript and works with any language or runtime.
dotenvx extends .env files with three capabilities missing from the original: encryption (secrets are encrypted in the file itself, making it safe to commit to version control), multi-environment support (separate encrypted files per environment — .env.development, .env.production — managed from one place), and CI/CD integration (encrypted values are decrypted at runtime using a key passed as an environment variable, with no special tooling required on the target system).
The migration path from plain .env is a single command: dotenvx encrypt. Existing code that reads environment variables requires no changes.
Placed in Tools / Assess / inner.
Plain .env files have a well-known security gap: they store secrets in plaintext, which means they cannot be safely committed to version control and must be manually distributed to each environment — a process that has no audit trail and creates real risk when developers leave a team or repositories are exposed. dotenvx closes this gap while preserving the .env mental model that every developer already knows.
The positioning on this radar is between two existing blips: Varlock (Tools/Trial/inner) handles schema-first AI-safe configuration with type validation, and Infisical (Tools/Assess/inner) is a full self-hosted secrets platform with a web UI, access control, and audit logs. dotenvx sits in the middle — more secure than plain .env, simpler to operate than a full secrets platform, and compatible with any existing project without code changes.
5,500 stars, provenance from the original dotenv creator, and a single-command migration path make this immediately evaluable. Inner position reflects zero migration friction for any project currently using .env files.
Moved to Hold. lpassrc (Trial/inner) covers the shell secret loading use case via the LastPass vault. The file-based encrypted secrets pattern dotenvx provides is not needed when vault-based loading is in active production use. Do not start new work with dotenvx; existing projects using plain .env files should migrate to lpassrc.
