commitsafe - a CLI tool to help you not to worry about exposing your secrets in your .env files when you commit them to your repository

NPM: commitsafe

How to install

# using npm
npm install -d commitsafe
# using bun
bun add -d commitsafe

CLI or commitsafe --help

Usage: commitsafe [options] <files...>

encrypt and decrypt environment variables in a file

Arguments:
  files            Files to encrypt or decrypt

Options:
  -l, --list       list given files and their keys
  -e, --encrypt    encrypt environment variables in a file
  -d, --decrypt    decrypt environment variables in a file
  -k, --key <key>  optional: key to encrypt or decrypt environment variables, defaults to a keys stored in ~/.commitsafe
  -h, --help       display help for command

What it does

# original .env file
HELLO=world

# after running `commitsafe -e .env`
HELLO=encrypted::U2FsdGVkX1/A1PgtAOSvOKQjs5CgGX+Y2gXGahVkgHc=

# after running `commitsafe -d .env`
HELLO=world

How to use

Single file

# encryption
commitsafe -e .env

# decryption
commitsafe -d .env

Multiple files

# encryption
commitsafe -e .env .env.local ...

# decryption
commitsafe -d .env .env.local ...

Using a key (useful for CI/CD)

# encryption
commitsafe -e .env -k my-secret-key

# decryption
commitsafe -d .env -k my-secret-key

List files and their keys

commitsafe -l .env .env.local ...

How to easily commit your .env files without worrying about exposing your secrets

Using pre-commit hooks with lint-staged and simple-git-hooks

1. Install the required dev dependencies

bun add -D commitsafe lint-staged simple-git-hooks

2. Run commitsafe -e .env once to add a encryption key

3. Add the following to your package.json and run bun run prepare

{
  // ... package.json
  "scripts": {
    "prepare": "bunx simple-git-hooks"
  },
  "lint-staged": {
    ".env*": ["commitsafe -e"]
  },
  "simple-git-hooks": {
    "pre-commit": "bunx lint-staged"
  }
}