secretenv

secretenvMulti-backend secrets via an alias registry

One registry. Every repo. Every backend. Migrate without touching a single repo.

Get Started
View on GitHub
🗂

Three files, three owners

secretenv.toml in the repo lists alias names. Machine config names backend instances. The registry — inside a backend you control — maps aliases to backend URIs.

Read the model

🔌

15 backends, one binary

AWS SSM, AWS Secrets, 1Password, Vault, GCP, Azure, Doppler, Infisical, Keeper, Cloudflare KV, OpenBao, Conjur, Bitwarden Secrets Manager, macOS Keychain, local files. No plugins. No feature flags.

All backends

🔁

Migrate without touching repos

Move a secret from 1Password to Vault: secretenv registry set. Every repo picks it up on the next run. No PRs, no re-encryption, no coordination.

Registry workflow

⚙️

CI-first integration

Set SECRETENV_REGISTRY once. OIDC patterns for GitHub Actions, GitLab, Jenkins, BuildKite, CircleCI. doctor --json as a pre-deploy gate.

CI/CD guide

🧭

Honest threat model

A workflow product, not a security product. We document what we eliminate, what we don't, and how the posture compares to .env, fnox, op-run, and direnv.

Threat model

📖

No SaaS, no lock-in

Open source, AGPLv3. No server. No account. The registry lives in your own backend. AGPL §13 only triggers on network-deployed forks.

How it compares

Quick Start ​

Install ​

bash
# macOS
brew install secretenv

# Linux / macOS (universal)
curl -sfS https://secretenv.io/install.sh | sh

# Cargo
cargo install secretenv

Configure your machine ​

bash
secretenv setup aws-ssm:///secretenv/registry --region us-east-1

Output:

✓ Registry configured as [registries.default]
✓ Registry reachable: 12 aliases found
✓ AWS credentials detected (profile: default)

Add a secretenv.toml to your project ​

toml
[secrets]
STRIPE_KEY   = { from = "secretenv://stripe-key" }
DATABASE_URL = { from = "secretenv://db-url" }
LOG_LEVEL    = { default = "info" }

Run ​

bash
secretenv run -- npm start

Secrets are fetched from whichever backends the registry points to, injected as env vars into the child process, and gone when it exits. No secret values written to disk.

How it fits together ​

The manifest says what the project needs. The machine config says which backends this machine has. The registry says which backend URI each alias resolves to.

Why the indirection?

Repos commit alias names like secretenv://stripe-key. The registry maps each alias to its current backend location. Migrating from 1Password to Vault becomes one secretenv registry set — every repo picks it up on the next run, no PRs.

For the full schemas, validation rules, and 5-phase resolution flow: The Three-File Model — Deep Reference.

Where to go next ​

  • Backends — 15 backend pages with config, URI format, examples, tested CLI versions
  • CLI Reference — every command, every flag, every exit code
  • CI/CD Integration — GitHub Actions, GitLab, Jenkins, BuildKite, CircleCI patterns
  • Threat Model — 14-category honest comparison with .env, fnox, op-run, direnv
  • Comparisons — when to pick secretenv vs. an alternative

Try it now

secretenv doctor is the front door for validating your config against any backend. Run it after install, after every config change, and as a CI pre-deploy gate.

Released under AGPLv3.

© 2026 TechAlchemistX