> ## Content Index
> Fetch the complete content index at: https://varops.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# I built an Open-Source Secrets Tool (Live Session) | S2E5
- URL: https://varops.com/osnt-i-built-an-open-source-secrets-tool-live/
- Published: 2026-07-15T19:02:00.000Z
- Updated: 2026-07-15T19:02:00.000Z
- Description: Live build of a Git-native tool that encrypts .env values in the repo and restores plaintext locally — from empty repo to production-level tool
- Author: Ran Aroussi
- Tags: Old School / New Tech

“Why can’t we just commit our `.env` files?” That question showed up in Ran’s feed. Instead of tweeting about it, he sat down and built the answer — live, from an empty repo to a working open-source tool.

Then OBS ate the first \~20 minutes. This cut is the recap plus the salvaged YouTube half of the session.

## The problem

Teams (and agent fleets) keep tripping over environment variables. Someone adds a key, forgets to tell everyone, the next `git pull` breaks the app. Sharing secrets out of band gets messy. Checking `.env` into Git in plaintext is a non-starter.

## What [Envapor](https://github.com/automazeio/envapor?ref=varops.com) does

Envapor is a Git-native utility that encrypts the *values* in your `.env` files:

- You edit `.env` locally like you always have
- On commit, Git stores it encrypted
- On checkout, you get plaintext back
- No `.env.enc` sidecar, no wrapper commands for the app, nothing new about how config loads

Deterministic encryption is the quiet hero: teammates share a PEM key, encrypt/decrypt at the Git boundary, and local diffs stay human-readable instead of ciphertext noise.

Key rotation matters too. When someone leaves, you don’t just rotate DB passwords — you migrate encryption from the old key to a new one they never had.

## How the session went

Started from a PRD in an otherwise empty repo. Agent-driven build (Factory’s [Droid](https://factory.ai/?ref=varops.com) in the mix, with model hops across the session — Opus, Fable, Soul when one path got weird). Parallel tracks for docs/user guide while the binary came up. Automaze’s **proof** skill for visual evidence that the CLI path actually worked.

Along the way: usability fixes (`init` finding the PEM without retyping), keygen strength, migrate edge cases, Homebrew + curl installers, a Git subcommand shim (`git envapor`), GitHub Actions on release, Apache licensing, and the judgment calls where an agent looks “done” but would ship a broken security tool if you weren’t watching.

Roughly two and a half to three hours of real build time; this edit lands around ninety minutes after the OBS failure and stitch.

## Why it belongs on Old School / New Tech

Old-school problem (don’t put secrets in Git). New-tech method (agentic live build, ship open source the same afternoon). The useful part isn’t the vibes — it’s the difference between a demo that greets you and a tool you’d trust with production secrets.