Skip to content

Releases: dnysaz/envgo

Release list

v1.0.1 — MODE_PUBLIC via .env + SSRF fix

v1.0.1 — MODE_PUBLIC via .env + SSRF fix Latest
Latest

Choose a tag to compare

View all tags
@dnysaz dnysaz released this 21 Sep 23:39
v1.0.1
72f6f2e

v1.0.1 — MODE_PUBLIC via .env + SSRF redirect fix

4 commits since v1.0.0

New

  • MODE_PUBLIC / CONFIG via .env — switch public/local mode without flags: MODE_PUBLIC=true (or MODE=public, PUBLIC_MODE, ENVGO_MODE) and CONFIG/ENVGO_CONFIG/ROUTES path. Flag --config still wins. Resolves relative paths against .env dir and --dir.
  • Help (-h) now shows Env (.env) overrides section.
  • envgo init template adds MODE_PUBLIC/CONFIG comments.

Fix

  • SSRF bypass via redirect — proxy and gateway now validate https:// and allowlist on every redirect (CheckRedirect). Previously https://httpbin.org/redirect-to?url=https://evil.com leaked secrets to evil.com.
  • envstore no longer redacts MODE_PUBLIC/CONFIG/HOST/PORT as secrets; .env.example sync ignores infra keys.
  • Improved CONFIG path resolution.

Docs

  • reference/cli-commands and core-concepts/environment-variables updated.
  • README documents .env overrides.

Assets

Built with CGO_ENABLED=0, go vet/go test pass. Verify with SHA256SUMS.

Install: see https://envgo.dev/download/ or https://github.com/dnysaz/envgo#install

Assets 11
Loading

envGo v1.0.0

envGo v1.0.0

Choose a tag to compare

View all tags
@dnysaz dnysaz released this 19 Sep 09:22
v1.0.0
7c8e991

First release. A zero-dependency, single-binary runtime that lets plain HTML and
vanilla JavaScript use .env secrets without ever exposing them to the browser.

What's included

  • Static file server + secure proxy in one binary. No Node.js, no runtime
    dependencies, nothing to install beyond the executable itself.
  • Local mode — /proxy guarded by a per-process session token plus Host
    and Origin validation.
  • Public mode — fixed /api/<name> routes defined in JSON, with per-route
    variable allow-sets, per-route/per-IP rate limiting, optional bearer auth, and
    response scrubbing.
  • Hot reload — edit .env and changes apply within about 1.5 seconds.
  • Dashboard at /__envgo_dashboard showing variable names and request
    metadata, never values.
  • PHP support — .php files executed server-side with .env injected, plus
    typo detection and warnings when source would print a secret.
  • TLS with an auto-generated self-signed certificate, TLS 1.2 minimum.
  • Scaffolding — envgo init and envgo deploy.

Downloads

Platform File
macOS (Apple Silicon) envGo-macOS-AppleSilicon.zip
macOS (Intel) envGo-macOS-Intel.zip
Linux amd64 envgo-linux-amd64
Linux arm64 envgo-linux-arm64
Windows amd64 envgo-windows-amd64.exe
Windows arm64 envgo-windows-arm64.exe

Install

macOS

Unzip the archive for your chip, then double-click Install_envGo.command. It
copies the binary to ~/.local/bin/envgo. If Gatekeeper blocks it, right-click
the file and choose Open, or run:

xattr -dr com.apple.quarantine envGo-macOS-AppleSilicon

Linux

uname -m      # x86_64 = amd64, aarch64 = arm64

sudo cp envgo-linux-amd64 /usr/local/bin/envgo
sudo chmod +x /usr/local/bin/envgo

Windows

Copy envgo-windows-amd64.exe to a folder, rename it to envgo.exe, and add
that folder to your PATH.

Verify

envgo -v     # envGo v1.0.0
envgo -h     # flag reference

Quick start

mkdir myapp && cd myapp
envgo init
envgo run dev

Known limitations

  • Streaming (SSE) responses are not scrubbed, so an upstream that echoes a key
    inside a stream will send it to the browser.
  • default_rate_limit is empty by default, which means unlimited — rate
    limiting must be opted into.
  • If PHP is unavailable or a script fails, the .php file is served as a static
    download rather than producing an error.
  • Rate limiting is per process and per IP; multiple instances multiply the limit.
  • The session token is not user authentication.

Documentation

Full documentation lives at https://github.com/dnysaz/envgo-site

Loading