Secrets
Should you commit .env files? What belongs in Git
Commit the template, never the values. Which .env files go in Git, what frameworks say, encrypted .env files, and where the real values should live.
Sharing .env files guide
Field notes on team secrets
Sourced write-ups on .env files, CI tokens, offboarding, contractors and audit logs, and on what a server that stores only ciphertext can and cannot see.
All posts
Secrets
source .env can run code: loading env files into a shell
set -a; source .env runs the file as a shell script, so $(…) and backticks execute. Why shells and dotenv parsers disagree, and safer ways to load .env.
Sharing .env files guide
Teams
When an admin leaves: the keys that sign everything
An admin holds the keys and accounts that vouch for everyone else's access. The order that closes them: ownership, vault keys, recovery channels, review.
Offboarding guide
Example. Kiteline is a fictional company.
More posts
Teams
7 min readWho saw which secret? Rebuilding access after someone leaves
Which API keys and credentials did a former employee access? What cloud and vault logs can tell you, what they can't, and how an exposure report helps.
Offboarding guide
Security
6 min readWhy a blind-server vault can't issue dynamic secrets
Dynamic secrets need a server that holds a privileged credential and uses it alone. A server that can't decrypt values can't, so Crunu doesn't offer them.
Who can decrypt guide
Self-hosting
8 min readWorkers, Vercel or Cloud Run: where to host a vault
Docker, Cloudflare Workers, Vercel or Google Cloud Run? What changes for a self-hosted Crunu server on each, the limits that matter, and two choices made once.
Self-hosting guide
Security
7 min readAudit logs you can verify: how hash chains work
An audit log is only evidence if nobody can quietly edit it. How hash chains make tampering visible, what they miss, and how to check an export yourself.
Offboarding guide
CI/CD
7 min readGiving CI only the secrets it needs
Long-lived CI tokens work from anywhere until revoked. How to scope pipeline secrets, keep production out of CI, and bind tokens to a repo with OIDC.
CI and OIDC guide
Teams
8 min readAn offboarding checklist for engineering teams
Removing an account takes seconds. Secrets outlive it. A practical checklist for engineering offboarding, from sessions and tokens to reissuing values.
Offboarding guide
Security
7 min readOne key per environment: why dev must not open prod
Server-side vaults separate dev and prod with permissions the server enforces. Why the boundary is stronger when each environment has its own encryption key.
Sharing .env files guide
Servers
8 min readSecrets on servers without files on disk
A .env file on a server outlives every deploy and ends up in backups. How an agent with a lease delivers secrets from memory, and what it cannot hide.
Self-hosting guide
Teams
7 min readSharing a secret with a contractor safely
Contractors need real credentials for real work. How to hand one over without leaving it in chat forever, and how to end their access cleanly afterwards.
Sharing .env files guide