Your current secrets workflow. We checked.
No judgement. We have all committed a .env and then force-pushed like it never happened.
Today: “hey can someone send me the .env” — asked in #general, answered in #general.
With EnvShare: They get an invite and a role. Nobody gets a DM.
Today: .env.local.final.v2 on one laptop is the source of truth. The laptop is on holiday.
With EnvShare: One source of truth per project and environment.
Today: Nobody knows who changed the Stripe key. Only that it was a Friday.
With EnvShare: The audit trail knows. It wrote it down.
Today: CI secrets typed into a settings page by hand, one typo at a time.
With EnvShare: A machine token and one command. CI gets what your laptop gets.
Not everyone needs the production password.
Access lives on the workspace, not in a file someone forwarded. Encryption at rest (locked before storage) is the floor, not the whole story.
- Roles
- Owner, admin, and member. Three, because nobody was going to maintain the 40-row permission matrix. Invite people before they have an account, and cancel a pending invite when access should stop.
- Audit trail
- Creates, updates, deletes, imports, exports, and CLI pulls that return values are written down. The log never stores the secret itself, so
git blamefinally has a rival. - Stay out of chat
- Stop pasting
.envfiles in Slack “just this once”. One source of truth per project and environment (release lane).
Workspace, then project, then environment. That's it.
A secret is a named value. It belongs to one environment inside one project. No tags, no folders in folders, no “it depends”.
Workspace
└── Project
├── development
│ ├── DATABASE_URL # localhost
│ └── RESEND_API_KEY
└── production
├── DATABASE_URL # not for Slack
└── RESEND_API_KEYWorks on my machine. Also in CI.
Create a machine token, then inject secrets into a process. Prefer run so values stay in memory, not in a file you will git add . at 2am.
node packages/cli/index.mjs login --token es_... --api http://localhost:3000 node packages/cli/index.mjs use -w acme -p atlas-api -e development node packages/cli/index.mjs run -- npm run devCLI details in the docs
Questions you were going to ask anyway.
Is it actually free, or “free”?
Actually free. Free to use, free to self-host, no upgrade wall for teams. The only catch is that you have to read the README.
What's wrong with keeping the .env in Slack?
Nothing, right up until someone searches “sk_live”. Chat is forever, has no roles, and has never once told you who copied the production database password.
Who holds the encryption key?
Whoever runs the server. Values are locked with AES-256-GCM before they are stored, so the database only ever sees ciphertext. Self-host and the key is yours, and we never see it.
Do I have to rewrite how my app reads config?
No. The CLI injects secrets as ordinary environment variables into the process you run. Your app keeps reading process.env like nothing happened.
Talk to a human. There is exactly one.
Found a bug, want a feature, or need to tell someone what you just pushed to main? This goes to a real inbox, not a ticketing system with a mascot.
EnvShare is built by Akale Godlove. Please do not paste secrets in the message. That is what the app is for.
Free to use. Free to host. Suspicious, we know.
Self-host EnvShare with Firebase and an encryption key you control. There is no upgrade wall for teams, and no seat math to do.