Blog
In-depth articles about what env-master is made of: identity-based secret delivery, rotation, auditing. No promises the product does not keep.
Taking secrets out of CI leaves exactly two lines behind
How a running service moved onto an external secrets store without downtime: two identities instead of a pile of CI variables, an order of steps that cannot be reversed, and a check that once pointed the opposite way.
Changing a PostgreSQL password without downtime: what ALTER USER actually does
Why ALTER USER never drops open connections, where the downtime of a database password change really comes from, and how to automate rotation so services never notice it.
Why .env files don't belong in production
How a .env file in production differs from one on a laptop: where it gets copied, who can read it, and how to drop it from your deploy without stopping the service.
Secret rotation without downtime: four phases instead of one long evening
Why rotation gets postponed until an incident, and how the create → set → test → finish automaton changes a database password while consumers keep reading the old one.
Machine identity: how a service proves it is itself
How a machine identity differs from a token in an environment variable: short-lived access, one-time enrollment tokens and scoping down to a key set.
Auditing access to secrets: what belongs in the log
How a secrets access log differs from a general activity feed: hash chains, anchors, and why the log never contains the values themselves.