01
Works with everything
Go, Flutter, Node, Python, Rust, Next.js, Docker, Vercel, Fly, K8s. If it reads .env, envlock works. No SDK. No code change.
Waitlist open · envlocksh.dev
Stop sending .env on WhatsApp.
A 9MB CLI that encrypts your .env and syncs it to your S3, R2, or GCS bucket. Secrets never touch our servers. We don't have servers.
One email when the binary ships. No drip.
What it is
Encrypt locally. Store in your cloud.
01 / init
envlock init --bucket=my-bucket
02 / push
envlock push --env=prod
.env.prod → s3://bucket/.env.prod.age
03 / pull
envlock pull --env=prod
new laptop, two seconds, no chat
curl -sSL https://envlocksh.dev | sh envlock init --bucket=my-bucket envlock push --env=prod envlock pull --env=prod
Why teams leave the vault
Your secrets stay in your account.
They hold the plaintext
Your S3 / R2 / GCS. Ciphertext only.
Vendor goes dark, you scramble
Files are .age. The age CLI still opens them.
A dashboard and a half-hour tour
A binary and thirty seconds.
In the binary
Six things it has to do.
02
age encryption
age + ChaCha20-Poly1305. Identity lives at ~/.envlock/identity.txt on your laptop. Never uploaded. A leaked bucket is still just ciphertext.
03
Invite. Revoke. Done.
envlock add priya@company.com — she can pull. envlock revoke intern@ — next push re-encrypts without him.
04
envlock check in CI
Five lines in GitHub Actions. Fails the build if .env.prod is missing keys, got committed, or a sk_live_ / AKIA / ghp_ slipped into the diff.
05
Inject anywhere
One source of truth. Push into Vercel, Fly, Kubernetes secrets, or GitHub Actions.
06
Audit log you can read
Who pushed prod. Who pulled. Which keys changed. A trail next to the files, not in a vendor sidebar.
Early access
Don't WhatsApp the next key.
Join the waitlist. We email once — when curl -sSL https://envlocksh.dev | sh is real.
One email when the binary ships. No drip.