From dotenv to dotenvx

With leaking secrets being such a big concern, it seems wise to require that secrets be encrypted to use dotenvx. That is, it will only work with encrypted secrets. As others…

dotenvx encryption goes a long way towards solving THE BIGGEST problem with dotenv; using multiple tools to ensure that secrets are protected. I wonder if dotenvx ensures that…

We implemented the exact same method for config encryption a year ago or so, using pub/private key auth and the same `encrypted:` prefixes for encrypted config values. This is a…

I don't think encryption is a good idea, and the reason is forming bad habits. Now developers have a very strong and non-ambiguous habit: never put .env files in version control…

This seems to encourage committing encrypted secrets, which is a bad idea. Configuration and code should be in separate repositories. Secrets should be protected elsewhere. The…

dotenv has zero npm dependencies. dotenvx has 21, including a few I have never heard of. Is this really more secure?

My beef with it is that it's written in Javascript whereas what it does is so simple that they should just code it up in Rust or Go and be done with it, particularly when it…

Thanks, but I would rather go with the imperfect setup that I understand than an allegedly perfect setup with dozens of third party dependencies that I don't understand. Doubly…

I think it's good advice to not pass secrets through environment variables. Env vars leak a lot. Think php_info, Sentry, java vm dumps, etc. Also, env vars leak into…

I don't get it. Dotenv is only good for local dev. Otherwise you should put your secrets in environment variables (the "env" in ".env"). That people put .env files in prod is a…

Secrets in env vars in production is not too secure either, ideally you’ll move to your app pulling secrets in-process from your infrastructure at boot-up or upon use. This also…

Would be nice to be able to configure which .env file to read as an environment variable. Why? Imagine a package.json with this line: `start: dotenvx run -f .env.local -f .env --…

I always thought highly of the approach used by https://www.npmjs.com/package/@strong-config/node Does dotenvx support secrets managers?

It doesn’t have Typescript types!

How would this work with application-specific Intellij Run/Debug configurations? Would this require switching to a "Shell Script" configuration, thereby losing debugging…

So with this, I have to prefix every executable with dotenvx in order to utilize the env variables? Can’t I somehow do this in the script itself so “ruby index.rb” is enough? I…

I'm not comfortable that this tool is able to make HTTP requests, IMO it ought to be completely offline and not perform network operations. I did a search for requests and found…

Seems pretty similar to sops[0], but without the encrypted-by-default feature that makes sops feel significantly safer for secret management. Sops also integrates easily with AWS…

Personally, I like sops for encrypting my secrets.

Can a kind soul point me some documentation on how to put .env in a vault correctly? Possibly open-source solutions? If the vault is password protected, aren't you just adding…

I’ve been using dotenv-cli for a long time now. I appreciate the encryption, but I will keep loading secrets from a vault instead.

I’ve been using dotenv-cli for a long time now. I appreciate the encryption, but I will keep loading secrets from a vault instead.

I always used foreman [0] which I found to be superior to dotenv in every way. Even superior to this new dotenvx [0] https://github.com/ddollar/foreman

I don't think this is the best approach. I am building https://phase.dev which lets you import secrets (.env), encrypt secrets (end-to-end encrypted with keys you control), sync…