Crunu vs sending .env files in chat and notes

Most teams start the same way. Someone needs the staging database URL, so a teammate pastes the .env file into a direct message. A new hire gets a note with the AWS keys. A contractor gets the Stripe key in a group chat. It works, it costs nothing, and nobody has to learn a new tool.

The trouble shows up later. The same values now live in chat history, in search, in exports and in the notes of whoever copied them. When someone leaves, nobody can say who saw which key, and the only safe answer is to reissue everything. This page compares that habit with Crunu honestly, including when the habit is good enough.

Who each approach fits

Chat and notes fit a solo developer or two people on a prototype with no production data, test keys only, and nothing to lose if a value leaks. They also fit a one-off handover where the value will be reissued right after.

Crunu fits any team where production keys exist, people join and leave, machines and CI need the same values, and someone will one day ask who had access to what.

Side by side

Where chat and notes are stronger

• No setup. Your team already uses the chat app. Crunu needs an account, and it has no mobile apps.
• Nothing extra to keep safe. Crunu adds a Secret Key and an Emergency Kit to your password, and its server cannot reset your password. Without the password, the Secret Key and the recovery code, nobody can open the account, Crunu included.
• Speed for a one-off. For a test key you will throw away tomorrow, a direct message is faster than any vault.

Why the habit is hard to undo

Copies multiply. A pasted file lands in the message history and in search, and Telegram cloud chats are readable from any of your devices. On paid Slack plans, messages and files are kept for the lifetime of the workspace unless an owner sets a retention policy. A note synced to the cloud is one more copy on one more service.

Exports reach further than the chat. Slack workspace owners and admins can export messages from public channels. On Business+ and Enterprise plans, exports of private channels and direct messages are available after an application.

Encryption protects transport, not the habit. Slack encrypts data in transit and at rest, and its Enterprise Key Management add-on lets Enterprise customers use their own keys. Telegram's cloud chats are stored encrypted in its cloud; only secret chats are end to end and tied to one device. None of this limits who in the conversation can read and copy the value.

Leaving has no clean answer. OWASP's guidance says exposed keys should be revoked immediately and that secrets should never be retrievable by everyone. When a teammate who was in the chat leaves, the safe assumption is that every key in it is exposed.

How Crunu handles the same moments

• New teammate. Invite them and give them an access profile, for example Editor on development and staging without production.
• Contractor without an account. Send a share link to selected files with an expiry, a view limit or a password. The decryption key sits in the link after the # and is never sent to the server. A messenger preview does not use up the link; it opens only when someone clicks Open.
• Server or pipeline. Enroll the server as a machine or create a service token bound by OIDC to one repository and branch.
• Someone leaves. The member removal flow rotates environment keys, revokes their tokens and links, and lists the values to reissue at providers.

Crunu cannot make anyone forget a value they already saw. Reissuing at the provider is still the fix for that, as the limitations page explains.

Moving to Crunu

1. Create an account and save your Emergency Kit.
2. Create a project per application, with development, staging and production environments.
3. Drag your .env files, or folders such as .aws, into each environment. Crunu reads KEY=VALUE files, INI sections, flat YAML and plain text. Personal keys like ~/.aws/credentials go into your personal project.
4. Invite the team and set roles per environment.
5. Delete the old messages and notes that held secrets, and reissue at the provider any production key that was ever pasted into chat.