v0.4.1

Fixes

• hush import no longer changes values with $ in them. The old parser expanded $VAR from your shell, so abc$HOME came in as abc/home/you and pa$word as pa. Values now come in exactly as written, and import lists any keys containing $
• Import errors on a malformed line now give the line number only. The old error printed the whole line, value included

Hardening

• Vaults saved in a newer format are refused instead of being opened and downgraded on the next save
• New passphrase vaults need at least 12 characters. Existing vaults aren't affected
• hush scan uses the same parser as import, so its counts match
• Dropped the dotenvy dependency in favor of a small built-in parser

Upgrading

No migration needed. If you imported values containing $ with an older version, run hush import on the same file again to fix them.

Grab a static Linux binary (x86_64 or arm64) below, or cargo install hush-env. The command is still hush.

v0.4.0

New

• hush doctor checks the vault folder, files, config, and key, one line per check. Read-only, and it exits non-zero when something's broken
• hush export prints a project's secrets in .env format on stdout (hush export > .env). hush never writes the file itself, and values are quoted so hush import reads them back exactly

Fixes and hardening

• Refuses vault folders that other users can read or write, and tells you the chmod 700 fix
• Refuses symlinks for the vault folder, vault.age, config.json, and vault.lock
• Temp files never follow a symlink, and the folder is synced after each rename so saves survive a power cut
• Fixed a race where two parallel hush init runs could replace each other's vault
• hush recover --from now takes the vault lock

Upgrading

No migration needed. The folder checks are stricter, so run hush doctor once after updating. Vault folders created by hush init are already fine.

Grab a static Linux binary (x86_64 or arm64) below, or cargo install hush-env. The command is still hush.