Sync .env Files Across a Dev Team Without a Cloud Account

Every team has the same problem. Someone joins the project, asks for the .env file, and gets it over Slack or email. Months later a key changes and half the team is on the old one. Staging works. Local doesn't. Nobody knows why.

The standard solutions are either "share a .env in a secret Notion page" (risky) or "pay for a secrets manager and reconfigure your entire deploy pipeline" (overkill for a five-person team). Envault is the middle path: a CLI that keeps your .env files in sync, with an audit trail, no cloud account required, MIT license.

Install

# via git (recommended — not on public PyPI)
pip install git+https://github.com/Coding-Dev-Tools/envault.git

Python 3.10+. MIT. No telemetry. No account.

rh-envault --version

How team sync actually works

Envault treats each environment — dev, staging, prod — as a named profile in a .envault.yml config that lives in your repo (with secrets excluded via .gitignore, naturally):

rh-envault init my-project

This creates .envault.yml with your project ID and empty environment stubs. Commit it. Every developer clones the repo and decrypts the shared environment file to get the current state:

rh-envault decrypt .env.dev.locked

No Slack DMs. No shared Google Doc. No "which version did you copy?" The team decrypts the same committed snapshot.

Catch drift before it reaches staging

The most common breakage pattern: dev adds a new env key, forgets to add it to staging, deploy fails at runtime. Envault's diff command surfaces this in CI before the PR merges:

rh-envault diff dev staging --fail-on-missing

Exit code is non-zero if staging is missing keys that dev expects. Wire this into your CI step and the PR gate catches it automatically — no post-deploy debugging.

Promote config from staging to prod

When staging is blessed and you're ready to promote:

rh-envault sync staging prod

This copies config values but leaves prod-specific secrets (like the production DB password) in place. It's not a flat overwrite — Envault knows the difference between config and credentials.

Onboard a new developer in 30 seconds

New team member, Day 1:

pip install git+https://github.com/Coding-Dev-Tools/envault.git
git clone 
cd 
rh-envault decrypt .env.dev.locked

That's it. The .envault.yml is already in the repo. The decrypt step restores their local dev environment from the committed encrypted file. No scavenger hunt through past Slack threads.

Audit who changed what

When a key rotates unexpectedly or a deploy breaks, the first question is "who changed this?" Envault logs every diff, sync, and rotate operation:

rh-envault audit

The output is queryable from the CLI. You get timestamps, changed keys, and the operation type — enough to reconstruct what happened without grepping git blame across a dozen commits.

Hook into secret stores for production

For production secrets you don't want in any file at all — even an encrypted one — Envault integrates with the stores your team may already have:

# AWS SSM Parameter Store
pip install "git+https://github.com/Coding-Dev-Tools/envault.git#egg=rh-envault[awsssm]"

# HashiCorp Vault
pip install "git+https://github.com/Coding-Dev-Tools/envault.git#egg=rh-envault[vault]"

# Doppler
pip install "git+https://github.com/Coding-Dev-Tools/envault.git#egg=rh-envault[doppler]"

# 1Password
pip install "git+https://github.com/Coding-Dev-Tools/envault.git#egg=rh-envault[onepassword]"

The CLI then pulls from the store directly instead of from a local file. Dev stays on local files; prod uses the store. No bespoke glue code per environment.

What the free tier covers

The diff/sync/encrypt/decrypt/audit loop is free on the local CLI. The free tier is rate-limited; paid tiers remove those limits.

Secret store integrations, unlimited team shared configs, compliance reports, the audit dashboard, and the REST API for CI sidecars unlock at paid tiers:

What this doesn't replace

Envault isn't a secrets manager in the HashiCorp or AWS Secrets Manager sense. It doesn't rotate database credentials automatically or handle secret versioning with per-service access policies. If you have a 50-person security team and SOC 2 requirements, you need the full managed tier or a dedicated secrets manager. If you have a 5–15 person dev team that keeps losing .env files and breaking each other's local setups, Envault is what fixes that.

Get started

pip install git+https://github.com/Coding-Dev-Tools/envault.git
rh-envault init my-project
rh-envault encrypt .env.dev

MIT. No telemetry. No account required for the free tier.

• GitHub — Coding-Dev-Tools/envault
• How to stop .env leaks and broken CI parity — the companion post for CI workflows

Disclosure: I built Envault, so take the recommendation accordingly. The workflows above are the same ones I use in my own projects.