envpilot — secret infrastructure for small teams
Nobody should have to ask
for the .env file.
A .env file is a secret with no owner, no expiry, and no memory of who read it. Envpilot gives every secret your team shares all three — variables, files, and logins alike — then hands them to your terminal, your editor, your CI, your API, and your agent from one scoped key.
envpilot vault --describe
four things live in here. only one of them is a .env file.
The ones that fit on a line
Same key, different value per environment, and every write keeps its history. Roll back to any prior value. Set a lifetime and get mailed before it expires.
DATABASE_URL
STRIPE_SECRET_KEY
REDIS_TLS_URL
SENTRY_DSN
+ 43 more
The ones that never did
Keystores, service-account JSON, SSH keys, certificates. Envelope-encrypted with a per-file data key, written to the path they belong at, never to the repo.
service-account.json
id_ed25519
fullchain.pem
The ones in the group chat
Shared logins for the dashboards that never shipped an API. Same roles, same audit trail, same revoke button as everything else in here.
grafana · ops@acme.dev
postmark · billing@acme.dev
The ones explaining the rest
Markdown pages living beside the secrets they describe. An agent can draft the runbook over MCP; shipping it needs a human holding project.docs.publish.
runbook/deploys
rotate-stripe-keys
+ 6 more
envpilot surfaces --list
one scoped key. the denial an agent gets is the denial CI gets.
Link a directory once, then run anything with its secrets already in the environment. Nothing lands on disk, so nothing leaks after the process exits.
pull · push · diff · switch · files · request
❯ envpilot init
✓ linked backend-api / staging
❯ envpilot run -- bun dev
✓ 47 variables injected into process env
envpilot whoami --capabilities
no feature in this codebase compares a role name. it asks the catalog.
| capability | owner | manager | lead | editor | dev | viewer |
|---|---|---|---|---|---|---|
| project.read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| project.variables.create | ✓ | ✓ | ✓ | ✓ | ✓ | · |
| project.variables.update | ✓ | ✓ | ✓ | ✓ | · | · |
| project.secrets.reveal | ✓ | ✓ | ✓ | ✓ | · | · |
| project.docs.publish | ✓ | ✓ | ✓ | ✓ | · | · |
| project.share | ✓ | ✓ | ✓ | · | ✓ | · |
| project.requests.review | ✓ | ✓ | ✓ | · | · | · |
| project.permissions.manage | ✓ | ✓ | ✓ | · | · | · |
| org.audit.view | ✓ | ✓ | ✓ | · | · | · |
| org.billing | ✓ | · | · | · | · | · |
Look at the share row. Developers can share a secret; editors cannot. No invented ladder produces that — it is the real profile, and it is editable. Roles are data; capabilities are code.
The owner column is derived, never hand-written — so a capability shipped on Tuesday cannot lock an owner out of their own organization on Wednesday. A test pins it.
Request, don't ask
A developer requests a variable instead of posting in a channel. The approval is the grant, and the request is the record.
Rotation on a calendar
Give a secret a lifetime and the clock is watched hourly, so rotation happens on a schedule instead of during an incident.
Hold, don't delete
Suspend a member across dashboard, CLI, extension, and API with one switch — permissions intact, history intact.
envpilot audit --days 7
every read is a row. this is the answer to “who saw this key”.
| time | actor | event | resource | origin |
|---|---|---|---|---|
| 14:02:11 | sara@acme.dev | variable.accessed | STRIPE_SECRET_KEY | 103.22.14.9 · Karachi, PK |
| 13:47:03 | ci-bot | cicd.secrets_pulled | production · 32 vars | GitHub Actions |
| 12:58:40 | claude-agent | project.docs.create | runbook/deploys (draft) | MCP · scoped key |
| 11:19:58 | omar@acme.dev | variable.requested | AWS_SECRET_KEY | 88.4.19.71 · Berlin, DE |
| 10:44:02 | unknown key | security.access_denied | envpk_…9f2c (revoked) | 51.12.8.240 · unknown |
| 09:03:40 | sara@acme.dev | variable.rotated | POSTMARK_TOKEN | 103.22.14.9 · Karachi, PK |
40+ event types · IP, user agent and location on every row · CSV and JSON export · retention set per plan · denials are recorded, not swallowed
envpilot plans
adding a teammate shouldn't be a budget conversation.
Up to 3 projects
50 variables per project
Up to 3 team members
CLI + VS Code Extension
Web Dashboard
AES-256 encrypted vault
Role-based access control
7-day audit log retention
Unlimited projects
Unlimited variables
Unlimited team members
Version history & rollback
Bulk .env import
Granular permissions
Secret rotation & expiry
365-day audit log retention
Priority support
why this exists
Every team starts the same way. Someone pastes the .env into a channel so the new hire can run the app. It works, so it happens again. Two years later that message is still there, the keys still work, and three of the people who can read it have left.
The tools that fix this are priced for companies with a procurement department. So small teams keep pasting, and the industry pretends that's a discipline problem rather than a tooling one.
Envpilot is the boring version: one flat price per organization, the whole platform MIT-licensed so you can read exactly how your secrets are handled — or run it yourself and never send us anything at all.
“It’s the tool I wanted: encrypted, synced, and boring to use.”
Abdul Rafay — founder, and the person who answers your support email
envpilot --help
the questions people actually send before signing up.
Where do my secrets actually live?
In WorkOS Vault, AES-256-GCM encrypted. Our database stores only reference IDs — a breach of our database yields zero plaintext secrets.
What happens to my data if Envpilot shuts down?
Your variables are exportable at any time — bulk export from the dashboard or pull everything with the CLI. No lock-in by design.
How is this different from Doppler or Infisical?
No per-seat pricing — one flat price per organization — and the whole platform is open source (MIT): run our zero-ops hosted cloud, or self-host it yourself. Built for small teams that share variables over Slack today, not for enterprise procurement.
Is Envpilot open source?
Yes — the entire platform (web app, CLI, VS Code extension, and backend) is MIT-licensed on GitHub. Read the code, audit how your secrets are handled, self-host it, or contribute a pull request.
What does the free plan include?
CLI, VS Code extension, and web dashboard for 3 projects and 3 teammates, with role-based access control and an audit log. No credit card required.
Can I use it in CI/CD?
Yes — the GitHub Action and service tokens pull your variables into any pipeline, with values masked in workflow logs.
Three commands and you'll never paste one again.
free plan · no card · MIT licensed · self-host any time
npm install -g @envpilot/cli
envpilot login
envpilot init
✓ backend-api / development linked
run anything with `envpilot run -- …`