enveil

enveil - a CLI tool to help you not to worry about exposing your secrets in your .env files when you commit them to your repository

NPM: enveil

Usage: enveil [options] <files...>

encrypt and decrypt environment variables in a file

Arguments:
  files            Files to encrypt or decrypt

Options:
  -e, --encrypt    encrypt environment variables in a file
  -d, --decrypt    decrypt environment variables in a file
  -k, --key <key>  optional: key to encrypt or decrypt environment variables, defaults to a keys stored in ~/.enveil
  -h, --help       display help for command

What it does

# original .env file
HELLO=world

# after running `enveil -e .env`
HELLO=encrypted::U2FsdGVkX1/A1PgtAOSvOKQjs5CgGX+Y2gXGahVkgHc=

# after running `enveil -d .env`
HELLO=world

How to use

Single file

# encryption
enveil -e .env

# decryption
enveil -d .env

Multiple files

# encryption
enveil -e .env .env.local ...

# decryption
envail -d .env .env.local ...

Using a key (useful for CI/CD)

# encryption
enveil -e .env -k my-secret-key

# decryption
enveil -d .env -k my-secret-key

How to easily commit your .env files without worrying about exposing your secrets

Using pre-commit hooks with lint-staged and simple-git-hooks

{
  // ... package.json
  "lint-staged": {
    ".env*": ["enveil -e"]
  },
  "simple-git-hooks": {
    "pre-commit": "bunx lint-staged --verbose && echo"
  }
}