A secure dotenv–from the creator of `dotenv`. @motdotla
LA & SF
Based in United States
- Tweets 3,021
- Following 11
- Followers 1,124
- Likes 1,081
Indeed. Competing projects seem to get all the attention here on twitter, but the cool-handed devs, they choose @dotenvx.
Thank you to all the other cool-hand devs like Chris here using dotenvx!
Man @dotenvx is such an underrated piece of technology. We use it for all our clients and our SaaS. Now you can run dotenvx protect once, and it protects you from agents accidentally committing unencrypted env vars 🔥
167
Thank you everyone for your support.
- In June dotenvx reached 30 million monthly installs.
- Dotenvx 2.0 was released
- dotenvx/next-env for Next.js was released
- Powershell support fully added
- Convenient dx _PLAIN values supported
- Improved monorepo support and more conveniences
Stay tuned. More coming - especially for Armored Keys.
$ dotenvx armor up
2
189
Polygon (@0xPolygon) has started using @dotenvx. Keep the .env. Encrypt the secrets.
github.com/search?q=org%3A0x…
89
.env files were never the problem.
Plaintext secrets were.
Dotenvx splits them:
◈ encrypted .env files in your code
◈ private keys kept separate
Two halves of a secret. Never stored together.
An attacker needs both.
Same workflow.
Smaller blast radius.
Whitepaper ↓
dotenvx.com/whitepaper.pdf
ALT dotenvx.com/whitepaper.pdf
4
96,250
Update notifications shipped - and they include information on whether the update is a:
◈ patch
◈ minor
◈ major
Secrets for agents – and developers.
For our early Ops ⛨ users I'm adding an update notification.
⛆ update available
Dotenvx will maintain zero update notifications (and zero telemetry) to keep it sharp and air-gappable.
But for dotenvx-ops we will add conveniences like updates and more. You will be able to skip the update check with --no-update flag.
199
A reminder that test-coverage matters.
Does your secrets manager have 100% test coverage?
This new wave of security incidents changes the equation.
The more complex your secrets manager, the larger your attack surface.
It's never been more real.
We worked with a red team to attack @dotenvx. Sharing findings soon.
1
263
Yes. Our log symbols alone were painstakingly designed to carry a lot of meaning in very little space.
Used consistently, they are becoming a learned visual language - fast to scan, easy to trust.
There's so much more craft in @dotenvx than competing secrets managers.
We don't have the breadth of features by design.
You can do everything in the kitchen with a sharp knife - if you make it sharp and balanced enough.
We are on that journey.
163
A reminder that Dotenvx was expressly designed to protect you from this scenario. It is architected this way where no other secrets solution is.
It is in our whitepaper:
> Vercel had a security incident.
> Rotate your environment variables now.
> But this is also a good time to remind your friends that @dotenvx was expressly designed to decrease the blast radius of this incident class.
> Help protect each other and stay safe out there!
1
177
Honored to welcome pkg (@robertsLando) as our third corporate sponsorship.
pkg carries dotenvx's binaries across every architecture.
It's a quiet force behind our distribution edge.
1
97
Introducing **Agent Usage**.
We're excited about @vercel's new skills.sh, a powerful new primitive. It feels like a shift: from code as something you run, to code as something you invoke. A new layer where agents gain real capabilities.
But with that shift comes a familiar problem. As agents become more capable, they need access to more secrets - API keys, tokens, credentials. And those secrets can't just sit in plaintext or be passed around loosely. They need to move with intention.
That's why we're bringing skills.sh into the dotenv ecosystem. So secrets stay sealed, encrypted at rest, and only revealed at runtime - flowing securely between your agents, exactly when and where they're needed.
2
211
Last week we tightened up all the log messages except for one.
The runtime message.
It is the most important.
Have given it a lot of thought.
Settling on this.
The ⟐ represents a decryption at runtime event.
It is like a keyhole - unlocked only when needed.
Then closed again.
1
83
New in 1.57.x Release:
◈ Error logs compacted to single line
◈ Error logs include links to GitHub issues (for help)
◈ Introduced leading glyphs as shorthand visual status language.
- ◈ success action (encrypted)
- ◇ success action (set plain value, decrypted)
- ⟳ success action (rotated)
- ○ informational no-op (no changes)
- ▣ success action for generated/updated support files
- ⚠ warning
- ☠ error
2
144
