DEV Community

Bharath B R
Bharath B R

Posted on

Why I Built InterEnv: Zero-Trust Hardware Enclave Secrets in Pure Rust

#rust #security #opensource #web3


Every developer knows the unwritten rule of software development: "Never commit your .env file to Git."

Yet, year after year, leaked .env credentials remain the number one attack vector for cloud account takeovers, API key thefts, and high-stakes crypto treasury drains.

A few days ago, I launched InterMCP (a lightweight, ultra-fast Model Context Protocol engine and gateway written in pure Rust) as the first utility from the Interlayer Blockchain lineup.

Today, I am proud to announce the second open-source utility from the Interlayer Blockchain lineup: InterEnv (v1.0.1).

I built InterEnv from scratch in 100% pure Rust to solve a critical vulnerability that has plagued developers for over a decade: the dangerous persistence of plaintext secrets on local developer disks.

The Origin: Why I Needed InterEnv for Interlayer Blockchain

While architecting the core node infrastructure, autonomous AI agents, and validator networks for Interlayer Blockchain, I had to confront a stark reality:

Validator signing keys (INTERLAYER_VALIDATOR_KEY), private keys (ETHEREUM_PRIVATE_KEY), OpenAI API keys, and cloud infrastructure tokens are routinely stored in .env files during development, testing, and automated agent runs.

On a developer machine or validator workstation:

  1. Plaintext .env files sit completely unprotected on physical storage. Any rogue npm or pip package running a post-install script can read your project directory with standard POSIX read permissions and exfiltrate your secrets over HTTP.
  2. AI coding assistants and IDE indexing tools scan your entire workspace. A misconfigured prompt or indexing pipeline can easily slurp raw .env files into an LLM context window.
  3. Accidental commits still happen every minute. Pre-commit hooks are often skipped or forgotten, leading to catastrophic leaks on public GitHub repos.

The False Promise of dotenvx and Cloud Vaults

When evaluating existing solutions, I found fundamental architectural compromises:

  • dotenvx: It encrypts the .env file into .env.vault, but stores the decryption key on the exact same hard drive in a plaintext .env.keys file. If malware or an unauthorized user can read your disk, keeping the key and the locked safe in the same room provides zero real security.
  • Cloud Secret Managers (1Password, Doppler, Infisical): While secure, they are cloud-locked, require expensive recurring subscriptions ($19–$39/user/month), and introduce 150ms–300ms network round-trip latencies on every local CLI command execution.

I wanted an engine that is 100% offline, local-first, free & open-source, executes in sub-millisecond native speed, and seals keys directly into silicon hardware.

How InterEnv Works: Silicon Enclaves & Zero Disk Footprint

InterEnv delegates master key security to the specialized cryptoprocessors already built into your laptop or server:

[ Your Plaintext .env ]
        │
        ▼  (interenv lock)
┌─────────────────────────────────────────────────────────────┐
│ 1. Generate XChaCha20-Poly1305 Master Project Key           │
│ 2. Seal Key inside Hardware Enclave (TouchID / TPM 2.0)      │
│ 3. Write encrypted `.interenv.lock` (Git-safe)              │
│ 4. DoD 5220.22-M 3-Pass Overwrite & Shred Plaintext .env     │
└─────────────────────────────────────────────────────────────┘
        │
        ▼
[ Physical Disk: 0 Bytes Plaintext ]
        │
        ▼  (interenv run <cmd>)
┌─────────────────────────────────────────────────────────────┐
│ 1. Request Master Key Unseal from Hardware Enclave          │
│ 2. Decrypt secrets strictly in Volatile Child RAM (< 1ms)   │
│ 3. Execute child process with memory-injected environment   │
│ 4. zeroize::ZeroizeOnDrop scrubs RAM buffers on exit        │
└─────────────────────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

1. Hardware Root of Trust

Instead of saving a key file to your disk, InterEnv seals your project master key inside your host hardware:

  • macOS: Apple Keychain backed by the Apple Secure Enclave with kSecAccessControlUserPresence (biometric TouchID or FaceID authorization).
  • Windows: Windows NCrypt (CNG) Key Storage Provider backed by hardware TPM 2.0 (MS_PLATFORM_KEY_STORAGE_PROVIDER) and Windows Hello.
  • Linux: Freedesktop Secret Service over D-Bus with hardware TPM 2.0 (tss-esapi) option.
  • Headless CI/CD: Automated password-derived Key Encryption Key (KEK) using Argon2id (64MB memory cost, 3 iterations) with non-interactive flags.

2. DoD 5220.22-M 3-Pass Physical Disk Shredding

When you run interenv lock, InterEnv doesn't just delete your .env file:

  1. Pass 1: Overwrites the entire file content with zero bytes (0x00).
  2. Pass 2: Overwrites the entire file content with ones (0xFF).
  3. Pass 3: Overwrites the entire file content with cryptographically secure pseudo-random bytes.
  4. Flushes the storage write buffer with fsync, truncates the file to 0 bytes, and unlinks it.

0 bytes of plaintext remain on your physical drive.

3. Volatile RAM-Only Execution (< 1ms Latency)

When you invoke interenv run <command>:

  • The master key is retrieved from your hardware enclave.
  • The ciphertext in .interenv.lock is decrypted with XChaCha20-Poly1305.
  • Environment variables are injected strictly into the child process's volatile memory environment block.
  • All internal memory structs implement zeroize::ZeroizeOnDrop, ensuring compiler memory fences wipe the plaintext from RAM the moment the command finishes. Secrets never hit swap or temporary files.

4. Kernel Sandboxing & 1-Click Git Guard

  • Pre-commit protection: Running interenv hook install installs a zero-friction git hook that automatically rejects any commit containing unstaged or unencrypted .env files.
  • OS Sandboxing: InterEnv includes options to jail child processes using Linux Seccomp BPF filters or Windows Job Objects to prevent unauthorized child processes from tampering with the host.

Architectural Comparison: Why Plaintext .env is Obsolete

Security Vector Plaintext .env dotenvx Cloud Vaults (Doppler/1P) InterEnv (Pure Rust)
Master Key Storage None Plaintext file on disk (.env.keys) Cloud Vault 🛡️ Hardware Enclave (TouchID/TPM)
Disk Plaintext Raw on disk Decrypted files exposed None 🧹 ZERO (DoD 3-Pass Shredded)
Cloud Dependency 100% Offline 100% Offline Required (Cloud-locked) ⚡ 100% Offline & Local-First
Pricing Free Free $19–$39/user/month 🟢 100% Free & Open Source (MIT)
Execution Speed Instant Slow (Node.js runtime) 200ms+ (Network RTT) ⚡ < 1 ms (Native Rust Engine)
Git Protection Manual Manual Complex Setup 🛡️ Built-in 1-Click Git Hook

10-Second Quickstart

1. Installation

Install globally via your preferred package manager:

# Via Cargo (Rust CLI)
cargo install interenv

# Via NPM (Node.js / TS — or execute on-the-fly with zero install)
npm install -g interenv
npx interenv --help

# Via PyPI (Python CLI & SDK)
pip install interenv

# Via Composer (PHP / Laravel / Symfony)
composer require bharathcoorg/interenv

# Via Go Modules (Go microservices)
go get github.com/Bharathcoorg/interenv/go/interenv
Enter fullscreen mode Exit fullscreen mode

2. Lock & Shred Plaintext Secrets

Navigate into any project containing an existing .env file:

interenv lock
Enter fullscreen mode Exit fullscreen mode

InterEnv binds the master key to your TouchID/TPM enclave, generates .interenv.lock, and wipes the plaintext .env from physical storage using DoD 5220.22-M 3-pass shredding.

3. Run Any Application in Volatile Memory

Prepend interenv run before your normal development commands:

# Node.js / Next.js / Web3
interenv run npm run dev

# Rust Applications & Nodes
interenv run cargo run

# Python AI Agents
interenv run python agent.py

# Docker Compose
interenv run docker compose up
Enter fullscreen mode Exit fullscreen mode

4. Edit Secrets Safely

Need to change a key? Running:

interenv edit
Enter fullscreen mode Exit fullscreen mode

opens your default $EDITOR inside a memory-backed buffer, allows you to modify your secrets, re-encrypts the file, and scrubs all temporary buffers upon exit.

Multi-Language SDK Support

In addition to the standalone CLI, I have published native client SDKs so developers can read enclave-locked secrets programmatically in their applications:

Open Source for the Community

While I originally engineered InterMCP and InterEnv for the Interlayer Blockchain ecosystem, secret hygiene is a universal challenge faced by every software engineer, cloud architect, and AI agent builder.

InterEnv is 100% open-source under the permissive MIT License.

I warmly invite you to try it out, review the codebase, and contribute:

Let’s kill plaintext .env files once and for all.

Top comments (0)