skills.rest
leonardoacosta
leonardoacostaCOMMUNITY
Explore all skills by this author →
GitHub

dotenvx-secrets

Inject, encrypt, and redact .env secrets with dotenvx when running coding agents.

Updated Aug 2, 2026
Search Tags:#secrets management#redaction#1password#dotenvx#credential security#env encryption#precommit guard
One-click install
npx skills add https://github.com/leonardoacosta/skills --skill dotenvx-secrets-leonardoacosta
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dotenvx-secrets
Source: https://github.com/leonardoacosta/skills/tree/main/leo-security/skills/dotenvx-secrets
Command: npx skills add https://github.com/leonardoacosta/skills --skill dotenvx-secrets-leonardoacosta

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Running a coding agent (Claude Code, Codex) against real credentials risks leaking API keys into transcripts, files, or commits. This Skill explains how to use dotenvx to inject, encrypt, and redact .env secrets, and — critically — what its redaction does and does not protect against. ## Core Features & Use Cases - Output redaction: Run agents via dotenvx run --redact -- <agent> so literal secret values in stdout/stderr are replaced with [REDACTED], with honest coverage of its exact-substring-matching limits. - Encryption and key handling: Encrypt .env files with dotenvx encrypt, manage .env.keys and DOTENV_PRIVATE_KEY per environment, and inject keys through CI or deployment vendors. - Vault references and guards: Resolve op:// (1Password) and bw:// (Bitwarden) references, enforce 1Password service-account vault access rules, and install dotenvx gitignore/precommit guards. - Use Case: Before letting an agent run database migrations with production credentials, wrap it in dotenvx run --redact --overload -- claude -p '...', keep .env encrypted, and store the private key in 1Password. ## Quick Start Ask the agent to run a command through dotenvx with redaction enabled, for example: wrap my next dev server in dotenvx run --redact --overload so my .env secrets are injected but never echoed back.

Frequently Asked Questions about dotenvx-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent a coding agent from leaking my API keys?▼

Run the agent via dotenvx run --redact -- <agent> so literal secret values in its stdout and stderr are replaced with [REDACTED]. Treat this as defense in depth only: scope the credential down and prefer short-lived tokens, since redaction does not stop exfiltration through files or network calls.

How does dotenvx --redact work and what are its limits?▼

dotenvx --redact performs exact literal substring replacement on the child process's piped stdout and stderr. It does not catch base64, hex, URL-encoded, case-changed, or partially disclosed secrets, nor anything leaving through files, network requests, or grandchild processes.

How do I encrypt .env files with dotenvx?▼

Run dotenvx encrypt to generate a keypair, write the public key into .env, the private key into .env.keys, and replace values with ciphertext. Never commit .env.keys; pass DOTENV_PRIVATE_KEY through CI or your deployment vendor instead.

Why is dotenvx redacting words like production or true?▼

dotenvx redacts every non-empty injected or pre-existing environment value with no length or entropy filter, so NODE_ENV=production blanks every occurrence of the word production. Rename non-secret keys with the _PLAIN suffix, such as NODE_ENV_PLAIN, to exempt them.

Can dotenvx resolve 1Password or Bitwarden secret references?▼

Yes, dotenvx resolves op://vault/item/field references via the 1Password CLI and bw://item/field references via the Bitwarden CLI at inject time. Pair references with --strict so an unresolved reference fails the run instead of passing the literal reference string to your program.

Does dotenvx precommit protect all clones of a repo?▼

No, dotenvx precommit --install writes a per-clone .git/hooks/pre-commit hook, so fresh clones and worktrees have no guard until it is run again. The hook blocks commits if dotenvx is unreachable via PATH or npx, failing safe rather than silently passing.

Related Skills

Explore More Software Engineering Skills→
0xHoneyJar0xHoneyJar
1

loa-credentials

Manage API credentials across environment variables, encrypted stores, and dotenv files.

Official
Intermediate
trmaphitrmaphi

dotenvx

Encrypts and decrypts .env files using AES-256 and keypair-based protection.

Community
Advanced
leonardoacostaleonardoacosta

dotenvx-secrets

Inject, encrypt, and redact .env secrets with dotenvx when running coding agents.

Community
Advanced
skinred78skinred78
1

Firebase + Cloud Run Deployment Skill

Deploy Flask/Python apps to Google Cloud Run with Firebase Hosting.

Community
Advanced