A CLI tool that syncs encrypted secrets across dev machines without a cloud account or self-hosted server

Small dev teams and solo developers share API keys and environment variables over Slack and Notion because every serious secrets manager (Doppler, Infisical) requires either a cloud account or self-hosted infrastructure they do not want to run. This CLI tool stores secrets locally in an encrypted vault, syncs them peer-to-peer across machines using end-to-end encryption, and injects them into any shell session or CI pipeline without touching a third-party server. No sign-up, no monthly per-seat SaaS fee, no ops overhead.

Demand Breakdown

563

Social Proof 3 sources

Ask HN: Developers/DevOps, how do you manage environment variables?

@HN community · 2023-12-12

355 HN

Environment Variables Are a Legacy Mess: Let's Dive Deep into Them

@signa11 · 2025-10-13

207 HN

Show HN: Envware - E2EE CLI to manage environment variables across devices

@humbertocruz · 2026-01-31

Gap Assessment

CompetitiveMultiple tools exist but differentiation opportunities remain

4 tools exist (Doppler, Infisical, dotenv-vault, 1Password Secrets Automation) but gaps remain: Requires a cloud account. No offline or peer-to-peer mode. Per-seat pricing becomes expensive for solo devs or micro-teams who just want to stop using Slack to share keys.; Self-hosting requires ops work. Cloud option means secrets leave your machine. No true zero-infra mode for a two-person team..

Features7 agent-ready prompts

Local encrypted vault with master passphrase

▶

Shell injection via `secrets run`

▶

Peer-to-peer encrypted sync over LAN or via a relay code

▶

CI/CD secret injection without a cloud account

▶

Project-scoped secret namespacing and environment tiers

▶

Secret rotation alerts and expiry tracking

▶

Audit log and breach detection

▶

Competitive LandscapeFREE

Product	Does	Missing
Doppler	Cloud-hosted secrets manager with a polished UI, CLI, and integrations for injecting secrets into any environment. $21/user/month Team plan. Raised $28.9M total including a $20M Series A in 2022.	Requires a cloud account. No offline or peer-to-peer mode. Per-seat pricing becomes expensive for solo devs or micro-teams who just want to stop using Slack to share keys.
Infisical	Open-source secrets platform (MIT core) with cloud or self-hosted options, PKI, PAM, and AI agent vaults. $18/user/month cloud. Raised $19.3M including a $16M Series A led by Elad Gil in June 2025; reportedly cash-flow positive.	Self-hosting requires ops work. Cloud option means secrets leave your machine. No true zero-infra mode for a two-person team.
dotenv-vault	Open-source CLI that encrypted and synced .env files. Once had a paid Pro tier.	Pro tier discontinued February 2026. No active sync feature remains. Project is essentially in maintenance.
1Password Secrets Automation	Extends 1Password into CI/CD secret injection via the 1Password CLI and service accounts. Natural fit for teams already paying for 1Password.	Requires an active 1Password subscription. Not a standalone product. No peer-to-peer or local-first option.