Product · StoreEnv

Sync

Zero-config discovery

StoreEnv reads your repository: the Git remote becomes the project, folders become services, file suffixes become environments.

Monorepos (apps/*, packages/*)
.env, .env.local, .env.production and any other suffix
Ignores node_modules and build output
Status works offline from a local cache of keyed hashes

$ storeenv status
  On project acme/cakeshop   (signed in as @tushar)
  Remote has a newer version on production (v 3b7e0d4 by @neha, 2h ago)
 
  Changes not pushed:
    backend/.env   ~ JWT_SECRET   + SENTRY_DSN

Protect

Encrypted before it leaves your machine

Each secret gets its own key and is sealed with AES-256-GCM. The scanner warns about live provider keys, malformed lines and env files that Git is tracking.

One key per secret, wrapped per reader
Identity from a 24-word recovery phrase
Private key kept behind your OS keychain
Ciphertexts are bound to their location

$ storeenv scan
  Scanned 3 env files, 22 keys.
  [warn] RAZORPAY_KEY_SECRET looks like a Razorpay live key (rzp_live_...)
  [warn] backend/.env line 14: duplicate key PORT (last value wins)

Share

Share these 3 keys, for 7 days

Access goes down to a single secret. A contractor's pull writes only the keys they were given. When access ends, the secrets they could read get new keys.

Roles: owner, admin, editor, viewer
Production needs a separate flag
Temporary access that ends by itself
GitHub collaborators are only suggested

$ storeenv invite @bob --role viewer \
    --keys backend/.env.production:DB_HOST,DB_USER --expires 7d
  Invitation sent to @bob (access expires in 7d).
 
$ storeenv revoke @bob
  @bob can no longer read acme/cakeshop.
  ! They may have copied these values. Rotate them at the provider:

Remember

Versions like commits

Every push records who changed which keys and why. Compare any two versions and roll back in one step. History only moves forward.

Key-level diffs, values only on reveal
Rollback creates a new version
Templates generated from real files
Activity log for pushes, reveals and grants

$ storeenv log --env production -n 3
  3b7e0d4  Added Razorpay keys   production  @tushar  2h ago   +2
  a19c55e  Rotate JWT secret     production  @neha    3d ago   ~1
  7d02f9b  Initial push          production  @tushar  12d ago  +12

Everything your .env files were missing

Zero-config discovery

Encrypted before it leaves your machine

Versions like commits

Stop pasting secrets into chat.