env-master documentation
env-master is a store for secrets and environment variables that services fetch values from themselves: over a trusted machine identity, on every start.
Start with the quickstart — it takes two commands. If you'd rather understand what the system is made of first, see the data model.
Where to start
| If you are… | Read |
|---|---|
| integrating a service | SDK |
| working from a terminal or CI | CLI and CI |
| responsible for security | Security |
| writing your own client | API reference |
What to know upfront
Secret values never leave the process into logs, files, or the network — this is the core rule the SDK, the CLI, and the CI action are built around. Log masking is on by default, and writing a value to disk requires an explicit action and warns about the consequences.
We do not promise zero-knowledge, and we explain where the boundary is: at rest only ciphertext is stored, but a live server process sees values while processing them.