Variables and secrets are one thing
Not two stores but one record with a visibility flag: plain is visible to everyone with project access, masked is handed over on an explicit audited request, restricted is never shown to a person.
What env-master does
A store for secrets and variables that services read themselves. Below is what the system does; where its guarantees end is written on the security page.
Versions and labels
Consumers read current, previous makes rollback a single action, pending holds a value that has been created but not yet applied. A rollback republishes the old value as a new version, so history stays monotonic.
Identity-based delivery
Universal Auth trades a client id and secret for a short-lived token; an enrollment token lives for minutes and exactly one use. Trading it twice means a leak — it is refused atomically and raises an alert.
Scoped down to a key set
An identity is bound to a project, an environment and, if you want, a list of keys: the billing worker gets DB_*, not the whole environment. An IP allowlist is available too.
Rotation without downtime
create → set → test → finish, idempotent and resumable from any phase. A new value becomes current only after the test passes.
Audit in two streams
Changes and reads, hash-chained together. The log carries key names and a value HMAC — enough to see that something changed, not enough to learn what.
Tooling
- SDK — fetches values at startup and keeps them in process memory, with token renewal and log masking.
- CLI — export, run to hand values to a child process, validate for pipelines and import to move off .env files.
- CI action — masks every value before anything can print it and places it in the job environment.
- Mobile client — the audit feed, alerts and approvals from a phone.
Environment completeness
A schema declares which keys are required and where. The validate command checks it against what the service actually holds and stops a deploy when a key is missing — before runtime rather than after. The check works on names; values are never disclosed.