⚿
SOPS + age encryption
SOPS + age 加密
Modern, battle-tested crypto. Values are encrypted at rest in your own Git repo.
现代、久经考验的加密。密钥值在你自己的 Git 仓库里加密存储。
Encrypted .env management for the AI-coding era — one vault for every project's secrets.
AI 编程时代的加密 .env 管理 —— 一个 vault 装下所有项目的密钥。
pipx install envseal-vault
The problem
痛点
.env..env。Claude Code, Cursor and friends make it cheap to spin up a dozen
repos a month. The secrets sprawl is the cost. EnvSeal scans every repository,
normalizes the .env* files, and syncs them into one
SOPS + age encrypted Git vault that you fully own — no SaaS,
no account, no lock-in.
Claude Code、Cursor 这些工具让你一个月开十几个仓库变得很轻松,
代价就是密钥四处散落。EnvSeal 扫描每个仓库,规范化 .env* 文件,
把它们同步进 一个 SOPS + age 加密的 Git vault ——
完全归你所有,无 SaaS、无账号、无锁定。
What you get
你能得到什么
Modern, battle-tested crypto. Values are encrypted at rest in your own Git repo.
现代、久经考验的加密。密钥值在你自己的 Git 仓库里加密存储。
Scan N repositories, keep a single encrypted vault. Unlimited projects.
扫描 N 个仓库,只维护一个加密 vault。项目数量不限。
diff, list and status show key names — never values.
diff、list、status 只显示 key 名称,绝不显示值。
New laptop? envseal pull rebuilds a project's .env in seconds.
换新电脑?envseal pull 几秒钟重建项目的 .env。
envseal report writes a static, key-only dashboard. Safe to share.
envseal report 生成静态、仅含 key 名的看板。可安全分享。
A drop-in CLAUDE.md/AGENTS.md snippet lets agents fetch secrets themselves.
一段 CLAUDE.md/AGENTS.md 片段,让 agent 自己取密钥。
How it works
怎么用
envseal init
Generate an age key, scan your repos, point at your vault.
生成 age 密钥,扫描你的仓库,指定 vault 位置。
envseal push --commit
Encrypt every .env* with SOPS and commit it to the vault.
用 SOPS 加密每个 .env* 并提交进 vault。
envseal pull <project> --env local --replace
Decrypt a project's secrets back into place — on any machine.
把项目的密钥解密还原到原位 —— 在任何机器上。
For AI coding agents
面向 AI 编程助手
Paste this into a project's
CLAUDE.md, AGENTS.md or .cursorrules.
When the agent hits a missing .env, it runs one command
instead of stalling or inventing fake keys:
把下面这段粘进项目的
CLAUDE.md、AGENTS.md 或 .cursorrules。
agent 遇到缺 .env 时会跑一条命令,而不是卡住或编造假密钥:
## Secrets & environment variables This project's .env* files are not committed — they are managed with EnvSeal (encrypted in a separate vault). - Create the local .env: envseal pull <PROJECT> --env local --replace - After editing a secret, sync it back: envseal push --commit - See which keys exist without decrypting: envseal list - Never commit .env*, never print secret values into logs.
More ready-to-paste prompts — docs/ai-agents.md
更多可直接粘贴的 prompt — docs/ai-agents.md
Why EnvSeal
为什么选 EnvSeal