.env file vs a secrets manager
A .env file is a copy on one machine. A secrets manager is one place every machine reads from. When each is enough, and what changes when you move.
A .env file is a copy. Every laptop, CI runner and server that needs the values has its own,
and nothing connects them. A secrets manager is the opposite: one place holds the values, and
every machine reads from it when it starts.
The everyday version is a phone number. Writing it on a sticky note for each person works for three people. By thirty, someone has the old number, and nobody knows who.
What a file cannot do
| Question | A .env file | A secrets manager |
|---|---|---|
| Who has this value? | Whoever was ever sent it | The members and machines listed, right now |
| Who read it, and when? | Nobody knows | An audit log, one line per reveal |
| Change a key everywhere | Send a new file to everyone | Change it once. It lands everywhere your code runs. |
| Someone leaves | Rotate every key they saw | Remove them. Their access stops |
| CI needs it | A long-lived token in CI settings | CI signs in with its own identity, no key to steal |
| Encrypted at rest? | Plain text on disk | Yes, each value under its own key |
None of these matter for a solo project on one laptop. All of them matter the first time a second person, a second machine, or a leaked key shows up.
What does not change
The part people fear is the app. It does not change. penv run puts the values into the child
process environment, and the app reads process.env.STRIPE_SECRET_KEY exactly the way it did
when the file was there. No SDK, no client library, no code change.
# before
node server.js # reads .env from disk
# after
penv run -- node server.js # reads from the cloud, same variables, nothing on diskThe schema is the same file in both cases. Penv checks the values against it before the app starts, whether they came from a file or from the cloud. Local mode and cloud mode describes the two states.
When a file is enough
A file is fine while every one of these is true:
- One person, or people who sit together and can rotate a key over a shoulder.
- No CI, or CI that runs with no credentials.
- No customer data behind the keys, so a leak is an inconvenience rather than an incident.
The moment any of those stops being true, the file starts costing more than it saves. The cost is invisible until a key leaks, and then it is the whole afternoon.
Moving is one command
penv pushThe values go to Penv Cloud, encrypted with a key per value, and the local file is deleted once
the write succeeds. penv pull brings a fresh file back at any time, so the move is reversible.
Encryption in the cloud says exactly what the server
can and cannot do with your values, including the fact that it can decrypt them to serve your
machines. That is the honest trade, and it is the one every hosted secrets manager makes.