Stop leakingsecrets.
evnx is a blazing-fast Rust CLI for validating, scanning, converting, and securing your environment files — before they become incidents.
The night that
cost $847
and a phone call.
I pushed a hotfix at 11:47 PM. I typed git add . when I meant git add src/. I didn't notice .env was tracked.
The key was live for 22 minutes. An automated scanner found it in four. By the time I woke up to the alerts, three services were down and someone was mining crypto in three AWS regions on my account.
The billing was painful. The call with my development lead at midnight was worse.
Three years and zero incidents later.
evnx is the pre-commit hook, the CI gate, and the doctor diagnostic I wish had existed that night.
// features
Everything your .env
workflow needs.
From secret detection to cloud migration — evnx handles the entire .env lifecycle.
Secret Scanning
Detects AWS keys, Stripe secrets, GitHub tokens, and high-entropy strings before they leave your machine.
Validation
Catches placeholders, weak secrets, boolean string traps, and localhost in production configs.
14+ Format Targets
JSON, YAML, Kubernetes, Terraform, GitHub Actions, Doppler, Infisical, Heroku, Vercel, and more.
Stack Blueprints
Init with pre-wired templates for Django, Next.js, FastAPI, Laravel, Rust, and more frameworks.
Bidirectional Sync
Keep .env and .env.example aligned — both directions, automatically.
Add Variables
Manage your .env entirely from the CLI. No manual file editing, no format mistakes.
Cloud Migration
Push directly to AWS Secrets Manager, Doppler, Infisical, or GitHub Actions secrets.
CI/CD Native
SARIF output for GitHub Security tab. Inline PR annotations. Exits 1 on findings.
Doctor Diagnostics
Health check everything: gitignore coverage, file permissions, .env.example sync, project structure.
Template Engine
Dynamic config generation with filters — |int, |bool, |upper — for multi-environment setups.
Encrypted Backups
AES-256-GCM encryption with Argon2 key derivation. Your backups are yours alone.
Zero Config
Works out of the box in any project. .evnx.toml unlocks team-level customization.
// install
Running in
under two minutes.
Single static binary. No runtime, no dependencies. Works on macOS, Linux, and Windows.
Install
One curl command or cargo install
Run doctor
evnx doctor — checks gitignore, permissions, .env.example sync
Add pre-commit hook
Blocks any commit containing a secret
curl -fsSL https://dotenv.space/install.sh | bash// commands
Built for your workflow.
// integrations
Ship with confidence.
evnx runs everywhere your code does.
name: evnx security scanon: [pull_request, push] jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: curl -fsSL https://dotenv.space/install.sh | bash - run: evnx scan --format github --exit-code
repos: - repo: local hooks: - id: evnx-scan name: Scan for secrets entry: evnx scan --exit-code language: system files: '\.env'
FROM rust:slim AS buildRUN cargo install evnx COPY .env .envRUN evnx validate --strict && evnx scan --exit-code
// get started
Don't wait for
your incident.
Install evnx, run evnx doctor, add the pre-commit hook. Five minutes of setup to avoid the worst conversation of your career.