“Why can’t we just commit our .env files?” That question showed up in Ran’s feed. Instead of tweeting about it, he sat down and built the answer — live, from an empty repo to a working open-source tool.
Then OBS ate the first ~20 minutes. This cut is the recap plus the salvaged YouTube half of the session.
The problem
Teams (and agent fleets) keep tripping over environment variables. Someone adds a key, forgets to tell everyone, the next git pull breaks the app. Sharing secrets out of band gets messy. Checking .env into Git in plaintext is a non-starter.
What Envapor does
Envapor is a Git-native utility that encrypts the values in your .env files:
- You edit
.envlocally like you always have - On commit, Git stores it encrypted
- On checkout, you get plaintext back
- No
.env.encsidecar, no wrapper commands for the app, nothing new about how config loads
Deterministic encryption is the quiet hero: teammates share a PEM key, encrypt/decrypt at the Git boundary, and local diffs stay human-readable instead of ciphertext noise.
Key rotation matters too. When someone leaves, you don’t just rotate DB passwords — you migrate encryption from the old key to a new one they never had.
How the session went
Started from a PRD in an otherwise empty repo. Agent-driven build (Factory’s Droid in the mix, with model hops across the session — Opus, Fable, Soul when one path got weird). Parallel tracks for docs/user guide while the binary came up. Automaze’s proof skill for visual evidence that the CLI path actually worked.
Along the way: usability fixes (init finding the PEM without retyping), keygen strength, migrate edge cases, Homebrew + curl installers, a Git subcommand shim (git envapor), GitHub Actions on release, Apache licensing, and the judgment calls where an agent looks “done” but would ship a broken security tool if you weren’t watching.
Roughly two and a half to three hours of real build time; this edit lands around ninety minutes after the OBS failure and stitch.
Why it belongs on Old School / New Tech
Old-school problem (don’t put secrets in Git). New-tech method (agentic live build, ship open source the same afternoon). The useful part isn’t the vibes — it’s the difference between a demo that greets you and a tool you’d trust with production secrets.
