Dotenvx

A secure dotenv–from the creator of `dotenv`. @motdotla

[Dotenvx @dotenvx]

A glimpse of what is coming next to Armor ⛨.
For those entrusted with secrets.

[Dotenvx @dotenvx]

Two years on.

[Scott Motte @motdotla]

A lot of visual work today. Seems counterintuitive in the increasing agentic world but my gut tells me the opposite.

[Dotenvx @dotenvx]

One of the greats instrumental in the development of @npm cli - without which dotenv would not even exist.

[Darcy Clarke @darcy]

Love the work @motdotla is doing with @dotenvx & am excited by what he's doing with Armor ⛨ - Our @vltpkg team got a excited when we first saw that first name change & appreciated Scott's willingness to adapt the name again to ensure there wasn't any confusion. Much love 🖤

[Dotenvx @dotenvx]

Keep .env. Encrypt it.

[acul @_aculll]

enkripsi file .env sekarang harus jadi standar, karena AI Agent kadang bisa akses. O iya ini aku pake Dotenvx

[Scott Motte @motdotla]

Out of an abundance of caution our major npm packages now ignore-scripts=true.

[Scott Motte @motdotla]

We have our SOC 2 controls all in place and monitored excepting one - the internal audit. We start that on Monday.

[Dotenvx @dotenvx]

@shunsuke_kudo_ Ok, great. This also might be helpful: https://t.co/xAtgnTkabs

[Dotenvx @dotenvx]

Polygon (@0xPolygon) has started using @dotenvx. Keep the .env. Encrypt the secrets.

https://t.co/0MjUSKS6uf

[Dotenvx @dotenvx]

Keep .env. Encrypt the secrets.

[紗愛夜 @SaaiyaChan]

環境変数管理、ずっと「平文をローカルに置く→事故がこわいし共有が面倒」だった。

そこで導入したdotenvx が今のところいい感じ。

.env ファイルを暗号化して git 管理、復号鍵はKeychain なんかに逃がす構成にした。

Railway にも push できるので、共有も楽！めっちゃ便利。

[Dotenvx @dotenvx]

May all our followers find great success and safe secrets!

[Dotenvx @dotenvx]

Keep the .env workflow developers already trust and add encryption.

[Dotenvx @dotenvx]

Encrypt and armor your .env files, friends.

[The Hacker News @TheHackersNews]

🚨 TrapDoor supply chain attack hits npm, PyPI, and Crates-io.

https://t.co/SYnR0fcJCr

34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments.

The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.

[Dotenvx @dotenvx]

@tonyjunkes thank you for the follow. May you wield the sharp knife and sturdy armor of dotenvx. ⛨

[Yoichi Kawasaki @yokawasa]

I built dtx — a minimal CLI on top of @dotenvx for easily switching and running encrypted environment variables.

Made with some vibe coding along the way.

https://t.co/kowvveUlrL

[Deian Isac @deanwithani]

@codyschneider Don’t forget to encrypt it with dotenvx or similar

[Dotenvx @dotenvx]

SOC 2 Status Update. We go to internal audit next week.

[Scott Motte @motdotla]

Ok so about 2 weeks into the SOC 2 process with @oneleet and we made the right choice.

I wanted a compliance solution that:

1. Organized policies and controls into practical language rather than "audit speak"
2. Mapped those controls tightly to audit requirements
3. Helped me understand the process deeply so we didn't feel locked into their platform

For #1, you can already start seeing the results on our trust page. Even the control categories are more practical and developer-friendly than what I've seen elsewhere.

For #2, their platform provides clear control mappings and detailed guidance, which helped me better plan ahead for auditor requirements as I built things out.

For #3, they provide an API. We've already automated a lot ourselves and pushed evidence directly into their dashboard. I don't feel locked in at all and have been able to wire things up to our company 'brain'. But their dashboard is also very intuitive and we're still spending most of our time directly in it and happy. Their automated controls they have are also really solid and save what otherwise is a lot of screenshot gathering.

Overall, @dotenvx is in a more secure position now and we'll continue to improve thanks to @oneleet. That's good for our customers and makes me happy. Looking forward to the internal audit next, and then the real thing.

[Dotenvx @dotenvx]

We've been very busy with SOC 2 preparation across our infrastructure and business processes, but in the meantime we did ship Team Avatars and Choose Key Storage.

[Dotenvx @dotenvx]

$ dotenvx encrypt

[CZ 🔶 BNB @cz_binance]

If you have API keys in your code, even private repos, now is the time to double check and change them...

[Dotenvx @dotenvx]

Did you know you can fetch a single secret with:

$ dotenvx get KEYNAME

Useful for peeking secrets or automation use cases.