Managing secrets across staging, production, and cloud providers usually means paying a monthly per-seat tax on SaaS tools or dealing with unwieldy HashiCorp Vault deployments. SecEnv CLI cuts through the bloat with a standalone, zero-dependency binary built in Go.
Zero-Dependency Security and Local Vaults
Under the hood, SecEnv encrypts local `.env.encrypted` files using AES-GCM-256 with key derivation handled by Argon2id. You keep your secrets in git history safely encrypted while keeping plain text secrets off disk when not actively in use.
Python Integration and Pre-Commit Hooks
Integrating SecEnv into existing Python microservices requires zero native C dependencies. You decrypt secrets at runtime directly into environment variables or inject them into your subprocesses.
import os
import subprocess
import json
def load_secenv_secrets(env_file=".env.enc", key_env_var="SECENV_MASTER_KEY"):
"""Decrypt and load secrets into os.environ at runtime without writing to disk."""
master_key = os.getenv(key_env_var)
if not master_key:
raise RuntimeError(f"Missing environment variable: {key_env_var}")
cmd = ["secenv", "decrypt", "--file", env_file, "--json"]
result = subprocess.run(cmd, capture_output=True, text=True, check=True)
secrets = json.loads(result.stdout)
for key, value in secrets.items():
os.environ[key] = value
if __name__ == "__main__":
load_secenv_secrets()
print(f"Loaded database target: {os.getenv('DB_HOST')}")Automated Multi-Cloud Drift Detection
SecEnv CLI compares local encrypted manifests against cloud providers like AWS Secrets Manager, GCP Secret Manager, Cloudflare Workers Secrets, and GitHub Actions Secrets. Running `secenv sync --provider aws` propagates changes instantly while detecting drift across environments.
With pre-commit hook integration and CI/CD automation recipes for Docker and GitHub Actions included out of the box, you can enforce zero-leak guarantees across your entire team without paying recurring SaaS fees.