Skip to content

Engineering / Open resources

EnvRune

A Go CLI that replaces .env files with an encrypted vault: secrets are referenced by name in a versionable envrune.yml and injected straight into the process, with masked output and end-to-end encrypted team sharing.

Documented flow

  1. Secret value

  2. Encrypted vault

    • XChaCha20-Poly1305
    • Argon2id

  3. Named reference

    • shop.stripe.test-key

  4. envrune.yml

    • Names only, versionable

  5. Process

    • Variables injected
    • Masked output
Architecture diagram: EnvRune
SVGPNG

Author diagram based on the case study; not complete client operational documentation.

Original text and diagrams: CC BY 4.0, credit Yago Lagrotti Bracco and link to the case study. Third-party interface images and brands are excluded from this license. CC BY 4.0

Project evidence

EnvRune