env-master documentation
env-master is a store for secrets and environment variables that services fetch values from themselves: over a trusted machine identity, on every start.
Start with the quickstart — it walks you through the steps in a few minutes. If you'd rather understand what the system is made of first, see the data model.
Where to start
| If you are… | Read |
|---|---|
| integrating a service | SDK |
| granting a service access | Services and identities |
| working from a terminal or CI | CLI and CI |
| responsible for security | Security |
| writing your own client | API reference |
What to know upfront
Secret values never end up in logs or files — this is the core rule the SDK and the CLI are built around. Over the network a value travels either as ciphertext (the machine path, decryption in your process) or over TLS (revealing a value to a human). Log masking is on by default, and writing a value to disk requires an explicit action and warns about the consequences.
We do not promise zero-knowledge, and we explain where the boundary is: at rest only ciphertext is stored, but a live server process sees values while processing them.