Sync and Secure Environment Variables Across Environments

Environment variable management is one of those problems every team has and nobody solves properly. Keys pile up across .env files. Secrets get rotated in prod but not staging. Someone pushes a .env.prod to GitHub by accident. A deployment breaks because STAGING_DB_URL was still pointing to a read replica that was decommissioned last month.

Envault is a CLI tool that brings order to your environment variables. It diffs environments, syncs with conflict resolution, rotates secrets with smart type inference, and integrates with AWS SSM, HashiCorp Vault, Doppler, and 1Password.

1. Install Envault

Or from GitHub:

Verify:

2. Initialize a Project

Create a configuration file that defines your environments:

This generates a .envault.yml file in the current directory:

project: my-project
environments:
  dev: .env.dev
  staging: .env.staging
  prod: .env.prod
conflict_strategy: source_wins
skip_keys:
  - COMMIT_SHA
  - BUILD_NUMBER

Now create some sample .env files to simulate real environments. Save as .env.dev:

DB_HOST=localhost
DB_PORT=5432
DB_NAME=myapp_dev
DB_PASSWORD=dev_password_123
API_KEY=dev_key_abc123
LOG_LEVEL=debug
FEATURE_NEW_CHECKOUT=true
FEATURE_DARK_MODE=false
CACHE_TTL=300

.env.staging:

DB_HOST=staging-db.internal
DB_PORT=5432
DB_NAME=myapp_staging
DB_PASSWORD=staging_password_456
API_KEY=staging_key_def456
LOG_LEVEL=info
CACHE_TTL=600

.env.prod with some drift and a missing key:

DB_HOST=prod-db.internal
DB_PORT=5432
DB_NAME=myapp_prod
DB_PASSWORD=prod_password_789
LOG_LEVEL=warn
CACHE_TTL=1200

3. Diff Environments

See exactly what's different between any two environments:

Envault produces a formatted diff showing keys that are:

• Only in source — present in dev, missing in prod
• Only in target — present in prod, missing in dev
• Different values — same key, different values

═══ Diff: dev → prod ═══

Only in dev:
  FEATURE_NEW_CHECKOUT=true
  FEATURE_DARK_MODE=false
  API_KEY=dev_key_abc123

Only in prod:
  (none)

Different values:
  DB_HOST: localhost → prod-db.internal
  DB_NAME: myapp_dev → myapp_prod
  DB_PASSWORD: dev_password_123 → prod_password_789
  LOG_LEVEL: debug → warn
  CACHE_TTL: 300 → 1200

You can also diff two .env files directly without a project config:

4. Sync Environments

Promote changes from one environment to another with controlled conflict resolution:

Always dry-run first. The output shows exactly what would change:

═══ Dry Run: sync dev → prod ═══

Would add:
  FEATURE_NEW_CHECKOUT=true
  FEATURE_DARK_MODE=false
  API_KEY=dev_key_abc123

Would update:
  LOG_LEVEL: warn → debug
  CACHE_TTL: 1200 → 300

When you're ready:

Envault also supports different conflict resolution strategies:

Key: DB_PASSWORD
Type: database password (inferred from key name)
Generated: L8#mKx2$rT9!qW5@nB4&
Updated in: .env.dev, .env.staging, .env.prod

# .github/workflows/env-check.yml
name: Environment Variable Check

on:
  pull_request:
    paths:
      - '.env*'
      - '.envault.yml'

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Envault
        run: pip install envault

      - name: Check for drift
        run: |
          echo "=== Comparing staging vs prod ==="
          envault diff staging prod || echo "⚠ Drift detected!"

      - name: Verify no secrets leaked
        run: |
          if grep -r 'password\|secret\|key' .env.* --include='.env*' 2>/dev/null; then
            echo "::warning::Potential secret in .env file"
          fi

# Rotate critical secrets before a production deploy
envault rotate DB_PASSWORD --env prod
envault rotate API_KEY --env prod --dry-run