.env files
cloakenv replaces unencrypted secrets with an encrypted binary vault and injects them
directly into child process memory. Stream stdout and stderr through --shield
to redact secret leaks in real time.
cargo install --locked cloakenv
--shield
When child processes log environment diagnostics, stack traces, or debug dumps, cloakenv --shield
intercepts stdout and stderr in-flight at the pipe boundary before bytes reach the terminal or disk.
It redacts the exact secret bytes, including a secret split across writes. It does not catch an encoded or transformed value (base64, reversed), and it does not cover a secret the command writes to a file or sends over the network.
[REDACTED_BY_CLOAKENV]How cloakenv keeps plaintext credentials off disk and out of the output it relays, and where that stops.
Secrets are serialized into an authenticated binary payload (.cloak/vault.bin) encrypted with XChaCha20-Poly1305.
Any tampering, truncated bytes, or invalid ciphertexts result in an immediate decryption abort.
Master passphrases are derived into cryptographic keys using memory-hard Argon2id (64 MiB memory, 3 passes), defending against brute-force GPU and ASIC cracking attacks.
When running cloakenv run -- cmd, decrypted values stay in memory and are passed directly into the command's environment, and cloakenv wipes its own copies. The command itself holds them in its environment, which other processes of your user can read through /proc/<pid>/environ.