Show HN: KeyEnv – CLI-first secrets manager for dev teams (Rust)

Show HN: KeyEnv – CLI-first secrets manager for dev teams (Rust)(keyenv.dev)

5 points by ivannovazzi 120 days ago | 2 comments

Hi HN,

I built KeyEnv because I was tired of the "can you Slack me the Stripe key?" workflow.

  The problem: My team's secrets lived in a mix of Slack DMs, shared Google Docs, and .env files that definitely weren't in .gitignore at some point. Enterprise tools like Vault required more DevOps time than we had. Doppler was close but felt
  heavier than we needed.

  What KeyEnv does:
  keyenv init          # link project
  keyenv pull          # sync secrets to local .env
  keyenv run -- npm start   # inject secrets, run command

  That's basically it. Secrets are encrypted client-side (AES-256-GCM) before leaving your machine. Zero-knowledge architecture—we can't read your secrets even if we wanted to.

  Technical details:
  - Single Rust binary, no runtime dependencies
  - Works offline (cached secrets)
  - RBAC for teams (owner/admin/member/viewer)
  - Service tokens for CI/CD
  - Full audit trail

  Honest tradeoffs:
  - SaaS only, no self-hosted option
  - Fewer integrations than Doppler
  - If you need dynamic secrets or PKI, use Vault

  Pricing: Free tier (3 projects, 100 secrets), $12/user/month for teams.

  Would love feedback on the CLI UX and any rough edges. Happy to answer questions about the architecture.

https://www.keyenv.dev

kxbnb 120 days ago |

Love the CLI-first approach for secrets. The Rust implementation should give you solid performance for dev workflows.

How does it handle rotation policies and audit logs? We've found that API key rotation is often where teams struggle with governance at keypost.ai.

Congrats on shipping!

ivannovazzi 119 days ago | |

Thanks! Audit logs are fully implemented. One special focus is obviously on granular permissions on environment access. About rotation: that's going to be the next big feature, planning to ship within the next 15 days! Would really appreciate some usage feedback, service has been migrated on proper hardware and is now fully functional (no cold starts on free instances).