xenvsync

Secrets management usually forces a choice between a cloud service you must trust (and pay for) and plaintext .env files that leak through chat, get lost, or get rebuilt by hand. xenvsync keeps secrets in git, encrypted end-to-end, with no SaaS in the loop — and adds asymmetric team sharing and in-memory injection that most tools skip.

• Single Go binary, zero runtime dependencies, cross-compiled for Linux/macOS/Windows via GoReleaser
• V1 symmetric: AES-256-GCM with a 32-byte key and a fresh 12-byte nonce per operation; the key lives in .xenvsync.key (mode 0600) with an optional scrypt-derived passphrase KEK
• V2 team sharing: X25519 ECDH per-member key slots from ephemeral keypairs — each member decrypts only their own slot; add or revoke members without re-encrypting history
• Vault file format wraps base64 ciphertext (and, for V2, the JSON key-slot array) with headers, so vaults are safe to commit
• .env parsing handles multiline and quoted values plus fallback merging (.env.shared < .env.<name> < .env.local)
• In-memory injection: xenvsync run merges secrets into the child process environment only — plaintext never touches disk or shell history
• Operability: key rotation, atomic member revocation, a git-diff audit log, and a verify/doctor pair that catches GCM auth failures, duplicate keys, and stale vaults