EnvKavach guide
An env secrets manager designed for safe collaboration
Encrypt secret names and values, isolate environments with separate data encryption keys, and record sensitive activity without exposing plaintext.
Authenticated encryption
AES-256-GCM detects tampering and uses a fresh random IV for every encrypted payload.
Envelope encryption
Each environment receives an independent DEK that is wrapped by a configurable key encryption provider.
Safe audit trails
Audit actors, actions, timestamps, targets, IP data, and versions—never secret values or uploaded .env contents.