Paste your keys once. Run any program — any language, any terminal — with secrets injected straight into its memory. No plaintext .env on disk. Ever. The Doppler/Infisical experience, self-hosted, free, and yours.
.env is the convenient way — not the safe way.A .env is plaintext on your disk that anything can read, and that gets committed to git by accident every single day — the #1 cause of leaked credentials on the planet. The Vault is strictly stronger on every axis.
plain .env | APxAI Vault | |
|---|---|---|
| At rest | plaintext | AES-256-GCM ciphertext |
| Master key | — none — | OS keychain, hardware-backed |
| Commit to git | one git add away | pre-commit guard blocks it |
| Per-secret keys | one file, one fate | unique HKDF key per secret |
| Tamper / swap | undetectable | name-bound (AAD) |
| Many apps | a .env per repo | one vault, ∞ linked apps |
No master key to invent or type — vault init generates one and locks it in your OS keychain.
Secrets live only in that process's memory, for its lifetime — never on disk, never in shell history, never in git. Works the same for python app.py, rails s, go run, docker compose.
Each app declares what it needs in a tiny .vault.json — just key names, safe to commit. Namespaces keep two apps' DATABASE_URL from ever colliding.
Every value is sealed with authenticated encryption approved for TOP SECRET. Tampering is detected, not just decryption-failed.
HKDF-SHA256 derives a unique key for every secret from a scrypt-hardened root. One key never guards two secrets.
Each secret's name is mixed in as AAD — so no one can transplant your STRIPE_TEST ciphertext into your STRIPE_LIVE slot.
Generated 256-bit and stored in your OS keychain (Secure Enclave on Apple silicon). Steal the vault file → you get useless ciphertext.
What it does NOT do (so you're never surprised): vault run doesn't sandbox the program you hand secrets to — that program can read the env you give it. That's the point. Scope each .vault.json to only what its app needs. Like all encryption, security reduces to protecting the master key — which is exactly why it lives in your keychain, not your hands.
Doppler charges per seat for exactly this. The CLI and your local vault are free and self-hosted — always.