Encrypt Your .env in a Meme(github.com)
github.com
Encrypt Your .env in a Meme
https://github.com/thoughtlesslabs/memevault
5 comments
The idea is about sharing secrets and keys not locking people out of the codebase.
Let's say you are using an OpenAI api key. The only people who can use your key are the ones you added their public key to the vault.
If you decide they can no longer have access, you change the secret and pull their public key from the repo.
This is no different then if you were sharing secrets in a .env except that they are not stored in plain text which is why you can upload it to github.
If you never give anyone access to the vault they can never use your secrets even if they have the code. They can create their own vaults and keys but they can't use yours.
Let's say you are using an OpenAI api key. The only people who can use your key are the ones you added their public key to the vault.
If you decide they can no longer have access, you change the secret and pull their public key from the repo.
This is no different then if you were sharing secrets in a .env except that they are not stored in plain text which is why you can upload it to github.
If you never give anyone access to the vault they can never use your secrets even if they have the code. They can create their own vaults and keys but they can't use yours.
Man- I am noticing so many people are writing and ruminating on the defense of the .env file right now!
I can't tell if the project name ("memevault") implies that this is a real tool or a jab at us ruminating weirdos X'D
I can't tell if the project name ("memevault") implies that this is a real tool or a jab at us ruminating weirdos X'D
Haha! In this case a real tool, but I wanted to have a little fun be embedding the secrets into memes.
You can actually use any image though
You can actually use any image though
Was thinking about how to make leaking keys less of an issue, especially as ai loves to just commit stuff. And why not store them in memes.
Memevault is a zero-dependency, single-binary secret manager that lets you keep encrypted project secrets anywhere by storing them inside a meme image. Instead of sharing `.env` files or relying on ad hoc workflows, teams can grant and revoke access per user, and the vault is re-encrypted accordingly. It works consistently across Windows, Linux, and macOS, injects secrets only into the environment of the command you run (`memevault run -- ...`), and includes key rotation plus a `scan` command to catch secrets referenced in code but missing from the vault.
Memevault is a zero-dependency, single-binary secret manager that lets you keep encrypted project secrets anywhere by storing them inside a meme image. Instead of sharing `.env` files or relying on ad hoc workflows, teams can grant and revoke access per user, and the vault is re-encrypted accordingly. It works consistently across Windows, Linux, and macOS, injects secrets only into the environment of the command you run (`memevault run -- ...`), and includes key rotation plus a `scan` command to catch secrets referenced in code but missing from the vault.
> To remove a team member:
> memevault access remove bob
> This immediately re-encrypts the vault with the remaining keys, locking Bob out.
Unless you rewrite the git history, force-push every branch, then do the same on every developers' computer (and ask Github support to garbage-collect your repo too), this actually does not "lock the Bob out", it just removes it from latest commit, but the Bob can still access every older commit.