Stop .env leaks and broken env parity in CI

Somewhere in your git history is a .env file that should never have been committed. The keys in it probably should have rotated months ago.

The usual response is more process: more review checklists, stricter access rules, more meetings. That doesn't fix the real problem, which is that someone is still copying secrets by hand.

Diff before you merge

This is the one that catches the actual leaks. Before code lands, compare the variables in the branch against what should be there:

rh-envault diff dev prod --fail-on-missing

If a key is missing or changed unexpectedly, the command exits non-zero and the CI gate stops the deploy. No guessing, no "I'll fix it in the next ticket."

Rotate as part of deploy

Don't rotate in a separate ticket queue that never gets picked up. Rotate in the branch, land it, sync to prod in the same pipeline:

rh-envault rotate DATABASE_PASSWORD --length 32

The tool infers the secret type — DB password, API key, JWT — and generates a value that fits. No text editor, no explaining to the team why it took three weeks.

Sync without overwriting what shouldn't move

Moving config from staging to prod should not accidentally overwrite a target-specific secret:

rh-envault sync staging prod

Secrets stay put unless you explicitly override them. The command copies only config values, not credentials that live in a separate store.

Audit every change

When something breaks, you need a record to check instead of relying on memory:

rh-envault audit

Every diff, sync, and rotate is logged. The output is queryable from the CLI, so you don't have to grep through git logs to find out who changed what and when.

Keep the plaintext surface small

The config file is Git-friendly. The secrets are not. Encrypt the .env files with a single master key and keep the encrypted file in version control. Treat the CI runner as a pass-through:

rh-envault export --format github-actions > $GITHUB_ENV

Avoid echo > .env inside a job — that just recreates the problem.

What the free tier covers

The free tier is the diff/sync/rotate loop. It works offline, has no telemetry, and requires no account. Secret store integrations (AWS SSM, HashiCorp Vault, Doppler, 1Password), bulk rotate-all, unlimited audit history, team shared configs, dashboard, and compliance reports unlock at the paid tiers.

Install

pip install git+https://github.com/Coding-Dev-Tools/envault.git
rh-envault init my-project

MIT, Python 3.10+, no telemetry, no account.

Disclosure: I maintain Envault, so take the example accordingly. The workflows above are the same ones I use in my own projects.

Docs: github.com/Coding-Dev-Tools/envault