Secrets management
from your terminal.
Stop sharing .env files over Slack. Encrypted storage, role-based access, and CLI-first workflow for teams that live in the terminal.
// features
Built for the command line
End-to-End Encryption
AES-256 encryption at rest via WorkOS Vault. Zero-knowledge architecture — we never see your secrets.
Role-Based Access
Three-tier RBAC with per-variable permissions. Members request access; leads and admins approve.
Audit Logging
40+ event types with IP, user agent, and location. Filter, search, and export for SOC 2 compliance.
Runtime Injection
Inject secrets directly into any process with envpilot run. No .env file written, nothing to leak. Fingerprint-gated cache keeps startup near-instant.
VS Code Extension
Real-time WebSocket sync. Multi-directory linking. Automatic file cleanup on access revocation.
Web Dashboard
Manage projects, variables, team members, and audit logs. Approve requests. Export compliance reports.
// workflow
From zero to running in four commands
// demo
No .env file. Ever.
# DON'T COMMIT THIS!
DATABASE_URL=postgres://admin:p@ssw0rd@prod.db:5432
API_SECRET=sk_live_4eC39HqLyjWDarj
AWS_SECRET_KEY=wJalrXUtnFEMI/K7MDENG
Leaked in #general 3 months ago
# No .env file. Secrets injected at runtime.
$ envpilot run -- bun dev
✓ Injected 12 vars from backend/staging ⚡ cache (4s ago)
DATABASE_URL → decrypted inline
API_SECRET → decrypted inline
Never written to disk. Gone when process exits.
// platform
Three surfaces, one vault
Terminal, IDE, or browser — your secrets stay encrypted and in sync everywhere.
$ envpilot login
$ envpilot init
$ envpilot run -- bun dev
$ envpilot pull --env production
$ envpilot push --dry-run
$ envpilot switch staging
> Envpilot: Sign In
> Envpilot: Link Project
> Envpilot: Pull Variables
> Envpilot: Add Directory
> Envpilot: Select Environments
> Envpilot: Request Variable
/ Projects & Environments
/ Variables & Secrets
/ Team & Permissions
/ Audit Logs & Exports
/ Version History & Rollback
/ Settings & Integrations
// pricing
Simple, transparent pricing
# Ready to secure your secrets?
$ npm install -g @envpilot/cli
$ envpilot login
$ envpilot init
Project initialized. Welcome aboard.