Blog
Why nvault exists, how it is built, and how zero-knowledge encryption holds up under a real threat model.
The safest .env file is the one that never exists. nvault run will fetch, decrypt, and inject configuration straight into a process. Here is where it fits.
A security product should be able to state plainly which attackers it stops and which it does not. Here is ours, without the marketing gloss.
nvault init should know which environment to restore without being told. It does that by reading your Git remote — deterministically, and never silently.
Pasting your account password into a CLI is a bad habit with real consequences. The device authorization flow gives the terminal access without ever seeing your credentials.
A lot of developer tools ship a thin API wrapper and call it a CLI. For nvault the terminal is a first-class surface, because that is where the hard use cases live.
Dotenv syntax is not a standard. Tools disagree about quotes, comments, multiline values and interpolation. So nvault stores bytes, not key-value pairs.
Config changes are the invisible cause of half of "it works on my machine." Treating every .env change as a version turns a debugging session into a diff.
The browser already encrypts your files. So why does the server encrypt them again before writing to Postgres? Because a database dump should be worth nothing.
Server-side encryption is easier to build and easier to use. We still chose client-side. Here is the threat model that made the decision for us.
What "the server can't read your data" actually means: key derivation, key wrapping, AEAD, and the specific hierarchy nvault uses to make it true.
Follow a single .env file from your editor to storage and back: what the browser does, what the API sees, and why the server can hold your secrets without being able to read them.
A leaked environment file is rarely one incident. It is a credential rotation, an audit, a customer email, and a week you do not get back. Why secrets sprawl is expensive.
Every team has a private ritual for moving .env files between machines. It is always insecure, and it always breaks. Here is the problem we set out to fix.