fnox

Secret management for command-line workflows eliminates insecure hardcoding by mapping environment variables to remote backends like Proton Pass. It syncs credentials to local encrypted age storage, retrieving them on demand to prevent exposure in shell history.

Using the mise plugin to load project-scoped secrets eliminates slow global shell activation. It retrieves environment variables on demand for active projects only, preventing credentials from lingering in shell history or global environments.

Yes, age encryption provides local encrypted storage for credential sync. You configure it as a secret provider to securely map environment variables, retrieving credentials on demand without hardcoding them in your project files.

You can troubleshoot misconfigured secret providers and incorrect environment variable mappings using built-in diagnostic commands. These commands identify and resolve profile-based secret resolution errors and configuration issues.

To avoid exposing credentials in shell history, use fnox exec to inject secrets directly into commands. This retrieves credentials on demand and passes them to the command environment without leaving sensitive data in shell logs.