Get the .env files out of your team chat
In a young team, secrets live wherever they landed first: a pinned message, a shared note, someone's laptop. Crunu gives them one place, encrypted on each person's device, with access that follows the job. It runs at app.crunu.com, so there's no server to set up.
Questions teams like yours ask
The questions that come up when a team like yours moves its secrets into one place. The guide below answers each of them.
- Where should our .env files live instead of the team chat?
- How does a new hire get the right variables on day one?
- Can developers work on staging without seeing production?
- Who changed this value, and what was it before?
- How do we give CI the staging variables and nothing else?
- How does production get its secrets without passing through CI?
- What do we change when someone leaves?
- Do we have to run a server for this?
The parts of Crunu that cover it
Every part works on the same rule: the server keeps ciphertext, public keys and signed documents, and never holds a key that opens your values.
Encrypted vault
Keep .env files, cloud credentials and API keys in projects and environments, encrypted on your devices before anything reaches the server.
Learn more
Access control
Give each person, machine and pipeline only the environments they need, with roles backed by encryption keys rather than by server checks alone.
Learn more
CI/CD
Give each pipeline a service token limited to its environments, and bind it to your CI provider with OIDC so a leaked token cannot sign in by itself.
Learn more
Machines
Enroll a server with a one-time code, and the crunu agent keeps its environments in memory and starts your programs with them.
Learn more
Offboarding
When someone leaves, the server stops serving them, the keys of their environments change, and a report shows what they saw and what to reissue.
Learn more
How it works for startups
On this page
What a growing team needs from its secrets
When five people build a product, everyone has every key. By fifteen, a new hire waits for someone to paste the right file, staging and production quietly drift apart, and nobody is sure who still has the production database password.
The job is easy to say: one copy of each value, read only by the people and machines that need it, and a clean exit when someone leaves.
From the first hire to the first audit question
| What you need | What Crunu does |
|---|---|
One place for every .env | Projects hold environments such as development, staging and production. Drag in .env files or whole folders; env, INI and flat YAML files are edited field by field. |
| New hires get the right access on day one | Invite someone with a link that's valid for up to 7 days, verify their fingerprint, and grant an access profile such as Developers: Editor on development and staging. |
| Developers can't read production | Each environment has its own key. Someone with development access never receives the production key. |
| Fewer "which value is right?" threads | Each environment keeps its last 100 versions with author, time and the names of changed fields. Compare staging with production and copy the values you pick. |
| CI that sees staging and nothing else | A service token gets only the environments you grant. A CI binding (OIDC) ties it to one repository and branch. |
| Production that stays on production | The production server runs the crunu agent and fetches its own environment. The pipeline only restarts the service. |
| A clean exit | Member removal rotates the keys of every environment the person could read, shows what they received, and lists the values to reissue at providers. |
A week from scattered files to one vault
- Create the organization. Sign up with your email. Your password and Secret Key are created in the browser, and you save your Emergency Kit.
- Add one project per app. Give it the environments you use and drag in the files you already have.
- Invite the team. Group access in access profiles, so a change to
Developersreaches everyone in it. - Connect CI. Create a service token for staging and paste the install steps the app shows into your pipeline.
- Finish the checklist. The app's Getting started list walks a new owner through a project, variables, a member, a machine and a second factor.
Things to know before you move in
- Access for people has no end date. Remove someone when their work is done. Invitations, share links, service tokens and machine leases do expire.
- No single sign-on or SCIM. Members sign in with a password, a Secret Key and a second factor.
- Owners and admins can reach every shared environment through the organization recovery key. Give those roles to the people who run the organization.
- What someone already saw stays with them. Rotation protects new versions; the values themselves are reissued at each provider.
- The server can't reset a password. If every owner and admin loses their password, Secret Key and recovery code, nobody can manage the organization. Keep two owners and keep the Emergency Kits.
Each limit, with what to do about it, is on the limitations page.
Free during early access
Every feature is included, within the limits listed on the pricing page. There's no payment step.
Related docs and integrations
Questions and answers
Not covered here? Write to support@crunu.com and a person will answer.
Is it really free?
Yes, during early access. Every feature is included and there's no payment step.
Do we need to run a server?
No. Sign up at crunu.com and your organization lives on app.crunu.com. The same server can also run on your own infrastructure: Docker, Cloudflare Workers, Vercel or Google Cloud Run. The server isn't published as a public download. Write to support@crunu.com.
Can a developer with staging access read production?
No. Each environment has its own key, and the production key is sealed only to the people and machines you grant production.
What if someone forgets their password?
The server can't reset it, because it never had it. If they created a recovery code, it gets them back in after a waiting period, and their account is notified while it runs. If a teammate loses both their password and their Secret Key, an admin can move their personal environments to a new account.
How far can we grow on it?
An organization holds up to 500 projects, a project up to 50 environments, and one environment up to 1 MB of content with an access list of up to 5,000 entries.
Can we take our data with us?
Yes. Export an environment as a single .env, as a password-protected file or to Ansible Vault, or download an offline copy of everything you can read. The offline copy opens with your password and Secret Key, without the server. Environments restricted by network aren't included in it.
Does Crunu support SSO?
No. There's no SAML or OIDC sign-in for people and no directory sync.