v0.4.0

New

• hush doctor checks the vault folder, files, config, and key, one line per check. Read-only, and it exits non-zero when something's broken
• hush export prints a project's secrets in .env format on stdout (hush export > .env). hush never writes the file itself, and values are quoted so hush import reads them back exactly

Fixes and hardening

• Refuses vault folders that other users can read or write, and tells you the chmod 700 fix
• Refuses symlinks for the vault folder, vault.age, config.json, and vault.lock
• Temp files never follow a symlink, and the folder is synced after each rename so saves survive a power cut
• Fixed a race where two parallel hush init runs could replace each other's vault
• hush recover --from now takes the vault lock

Upgrading

No migration needed. The folder checks are stricter, so run hush doctor once after updating. Vault folders created by hush init are already fine.

Grab a static Linux binary (x86_64 or arm64) below, or cargo install hush-env. The command is still hush.