Encrypted .env secrets in Git for monorepos. SOPS + age, policy-based access control, CLI, and interactive TUI.

Managing secrets across multiple services and environments is hard:

• Sharing .env files in chat/email is unsafe.
• Keeping secrets in CI settings is hard to review and version.
• Onboarding and offboarding access is often manual and error-prone.
• Access revocation usually requires additional manual cleanup.

git-env-vault keeps encrypted secrets next to code while controlling who can decrypt each environment/service.

• Encrypted secrets stored in Git (*.sops.yaml).
• Service-to-output mapping (envvault.config.json).
• Policy-based recipients (envvault.policy.json + .sops.yaml).
• Safe-by-default diffs (keys only, no values by default).
• Access lifecycle commands (grant, revoke, updatekeys, rotate).
• Local override promotion (promote, promote-all).
• CI validation (ci-verify).
• Interactive terminal UI (envvault tui).

• Node.js 18+
• Git 2+
• SOPS 3.8+
• age 1.1+

# project dependency (recommended)
npm i -D git-env-vault

# global install
npm i -g git-env-vault

# macOS
brew install sops age

# Windows (winget)
winget install sops
winget install age

age-keygen -o ~/.config/sops/age/keys.txt

envvault init

Generated files:

• envvault.config.json
• envvault.policy.json
• .sops.yaml
• secrets/

envvault grant --env dev --service api --recipient age1...

# interactive mode
envvault tui

# or direct commands
envvault edit --env dev --service api
envvault pull --env dev

envvault ci-verify

• Getting Started
• CLI Reference
• Workflows
• Security Guide
• Configuration
• Security Model
• Troubleshooting
• Optimization Guide

• envvault init
• envvault pull --env <env> [--service <service>]
• envvault edit --env <env> --service <service>
• envvault set --env <env> --service <service> KEY=VALUE...
• envvault doctor

• envvault grant --env <env> --service <service> --recipient <age-public-key>
• envvault revoke --env <env> --service <service> --recipient <age-public-key>
• envvault updatekeys [--env <env>] [--service <service>]
• envvault rotate --env <env> [--service <service>]

• envvault promote --env <env> --service <service> --key <key>
• envvault promote-all --env <env> --service <service>

• envvault hooks install --type pre-push|pre-commit
• envvault hooks uninstall --type pre-push|pre-commit
• envvault hooks status
• envvault wizard
• envvault up --env <env>
• envvault ci-verify [--allow-unsigned]
• envvault tui

Core files are present in this repository:

• README.md
• LICENSE
• CONTRIBUTING.md
• CODE_OF_CONDUCT.md
• SECURITY.md
• SUPPORT.md
• CHANGELOG.md
• .github/ISSUE_TEMPLATE/*
• .github/PULL_REQUEST_TEMPLATE.md

npm install
npm run build
npm run test
npm run lint

• Support Guide
• Open an issue
• Security Policy
• Website

Maintained by PAS7 Studio.

MIT. See LICENSE.