DevVault – Local secret manager and runtime env injector in Go

Saravanakumar G — Wed, 23 Sep 2026 05:13:50 +0000

Hey everyone,
I built DevVault, an open-source CLI tool in Go to solve a problem most developers deal with: keeping sensitive API keys and database credentials in unencrypted .env files.
Instead of storing plaintext credentials on disk, DevVault encrypts them locally and injects them directly into your application at runtime without creating .env files.
How it works:
AES-256-GCM & Argon2id: Encrypts secrets at rest in a local SQLite vault with high-memory key derivation (64MB RAM, 3 iterations, 4 threads).
Runtime Injection (devvault run): Decrypts secrets in memory and injects them into child process environment variables (devvault run -- node app.js).
Non-Echoing Interactive Entry: devvault set KEY prompts for hidden input without terminal echo so secrets don't end up in your shell history.
Profile Isolation: Separate vaults for default, staging, and production with independent salts.
Git Secret Scanner & Pre-Commit Hook: Built-in entropy scanner (devvault scan) and hook (devvault install-hook) prevent staged credentials from reaching Git.
Encrypted Export/Import: Export vaults into standalone .dv backup files.
DevVault is open source, zero-config, and available for Windows, Linux, and macOS.

🔗 GitHub Repo: https://github.com/Saravanakumar2602/DevVault

📦 v1.0.1 Release: https://github.com/Saravanakumar2602/DevVault/releases/tag/v1.0.1

💻 Install via Go:

go install github.com/Saravanakumar2602/DevVault/cmd/devvault@latest
Would love to get your feedback and thoughts!

DEV Community: Saravanakumar G

DevVault – Local secret manager and runtime env injector in Go