Stop pasting .env files
into Slack.
Envpilot keeps your team's environment variables in sync — CLI, VS Code extension, and web dashboard. Encrypted end to end, open source (MIT). Free for small teams, no credit card.
AES-256
encrypted in vault
0
plaintext secrets stored
< 2 min
to first injected secret
$0
for small teams · no card
No .env file. Ever.
The .env file is a liability with a filename. Envpilot replaces it with encrypted, access-controlled runtime injection.
# DON'T COMMIT THIS!
DATABASE_URL=postgres://admin:p@ssw0rd@prod.db:5432
API_SECRET=sk_live_4eC39HqLyjWDarj
AWS_SECRET_KEY=wJalrXUtnFEMI/K7MDENG
Leaked in #general three months ago. Still valid.
# No .env file. Secrets injected at runtime.
❯ envpilot run -- bun dev
✓ Injected 12 vars from backend/staging ↻ cache (4s ago)
DATABASE_URL → decrypted in memory
API_SECRET → decrypted in memory
Never written to disk. Gone when the process exits.
Zero to running in four commands
Install
One global package. Works with npm, bun, pnpm, and yarn.
❯ npm install -g @envpilot/cli
added 1 package in 2.3s
Login
Browser-based SSO — no API keys to paste into your shell history.
❯ envpilot login
✓ Authenticated as dev@company.com
Init
Link any directory to a project and environment in seconds.
❯ envpilot init
✓ Linked to project: backend-api (staging)
Run
Secrets land in process memory, never on disk. That's it — you're running.
❯ envpilot run -- bun dev
✓ Injected 47 variables from backend-api/staging
Built for the command line
Everything your team needs to stop treating secrets like chat messages — encrypted, access-controlled, and fully auditable.
Runtime Injection
Inject secrets directly into any process with envpilot run. No .env file written, nothing to leak. Fingerprint-gated cache keeps startup near-instant.
❯ envpilot run -- bun dev
✓ 47 vars injected into process env
✗ .env file written → never
✗ secrets on disk → gone when the process exits
End-to-End Encryption
AES-256 encryption at rest via an isolated vault. Zero-knowledge architecture — plaintext secrets never touch the database.
DATABASE_URL=postgres://admin:•••@prod:5432
a4f7c2…91e8d3…b06f4a…aes-256-gcm
✓ sealed in vault — reference id stored, value never touches the database
Role-Based Access
Role-based access with per-variable permissions. Developers request access; leads, managers, and owners approve.
Audit Logging
40+ event types with IP, user agent, and location. Filter, search, and export for SOC 2 compliance.
VS Code Extension
Real-time WebSocket sync, multi-directory linking, automatic file cleanup the moment access is revoked.
Web Dashboard
Manage projects, variables, teams, and audit logs. Approve requests and export compliance reports.
Three surfaces, one vault
Terminal, IDE, or browser — your secrets stay encrypted and in sync everywhere your team works.
CLI Tool
❯ envpilot login
❯ envpilot init
❯ envpilot run -- bun dev
❯ envpilot pull --env production
❯ envpilot push --dry-run
❯ envpilot switch staging
12 commands. Runtime injection. Browser SSO. CI/CD ready.
VS Code Extension
> Envpilot: Sign In
> Envpilot: Link Project
> Envpilot: Pull Variables
> Envpilot: Add Directory
> Envpilot: Select Environments
> Envpilot: Request Variable
Real-time WebSocket sync. Multi-directory. Auto-cleanup on revoke.
Web Dashboard
/ Projects & Environments
/ Variables & Secrets
/ Team & Permissions
/ Audit Logs & Exports
/ Version History & Rollback
/ Settings & Integrations
Full management UI. Approve requests. Compliance exports.
Built in the open
Not a slogan — the whole platform is MIT-licensed on GitHub. Read the code, self-host it, or open a PR. A real product, a reachable founder, and a public changelog you can hold us to.
Abdul Rafay
founder & the person answering your support email
“I built Envpilot after watching one too many production keys get pasted into Slack channels half the company could scroll. It’s the tool I wanted: encrypted, synced, and boring to use.”
MIT licensed · self-host it
changelog — shipping weeklypublic roadmapUsing Envpilot? The best lines end up here with your name on them.
ceo@envpilot.devSimple, transparent pricing
Start free. Upgrade when you need more power. Every plan includes AES-256 encryption, RBAC, and real-time sync.
Up to 3 projects
50 variables per project
Up to 3 team members
CLI + VS Code Extension
Web Dashboard
AES-256 encrypted vault
Role-based access control
7-day audit log retention
Unlimited projects
Unlimited variables
Unlimited team members
Version history & rollback
Bulk .env import
Granular permissions
Secret rotation & expiry
365-day audit log retention
Priority support
Before you ask
Where do my secrets actually live?
In WorkOS Vault, AES-256-GCM encrypted. Our database stores only reference IDs — a breach of our database yields zero plaintext secrets.
What happens to my data if Envpilot shuts down?
Your variables are exportable at any time — bulk export from the dashboard or pull everything with the CLI. No lock-in by design.
How is this different from Doppler or Infisical?
No per-seat pricing — one flat price per organization — and the whole platform is open source (MIT): run our zero-ops hosted cloud, or self-host it yourself. Built for small teams that share variables over Slack today, not for enterprise procurement.
Is Envpilot open source?
Yes — the entire platform (web app, CLI, VS Code extension, and backend) is MIT-licensed on GitHub. Read the code, audit how your secrets are handled, self-host it, or contribute a pull request.
What does the free plan include?
CLI, VS Code extension, and web dashboard for 3 projects and 3 teammates, with role-based access control and an audit log. No credit card required.
Can I use it in CI/CD?
Yes — the GitHub Action and service tokens pull your variables into any pipeline, with values masked in workflow logs.
The last .env file
you'll ever paste.
Set up your first project in under two minutes. Free plan, no credit card required.
❯ npm install -g @envpilot/cli
❯ envpilot login
❯ envpilot init
Project initialized. Welcome aboard.