English | ็ฎไฝไธญๆ | ็น้ซไธญๆ
Lightweight Environment Variable Security Management CLI Engine
EnvShield ๆฏไธๆฌพ่ฝป้็บง็ฏๅขๅ้ๅฎๅ จ็ฎก็ CLI ๅผๆ๏ผไธไธบไฟๆคๅบ็จ็จๅบๆๆ้ ็ฝฎ่่ฎพ่ฎกใ
ไธบไปไน้่ฆ EnvShield๏ผ
ๅจๆฅๅธธๅผๅไธญ๏ผๆไปฌ็ปๅธธ้ขไธดไปฅไธ็็น๏ผ
.envๆไปถไปฅๆๆๅญๅจๅจ้กน็ฎ็ฎๅฝไธญ๏ผไปปไฝๆฅๆไปฃ็ ่ฎฟ้ฎๆ้็ไบบ้ฝ่ฝ็ๅฐๆฐๆฎๅบๅฏ็ ใAPI ๅฏ้ฅ็ญๆๆไฟกๆฏ- ๅข้ๅไฝๆถ๏ผๅฏ้ฅ้่ฟๅณๆถ้่ฎฏๅทฅๅ ทๆ้ฎไปถไผ ้๏ผๅญๅจๆณ้ฒ้ฃ้ฉ
- ็ผบไน็ณป็ปๅ็ๅฎๅ จๅฎก่ฎกๆๆฎต๏ผ้พไปฅ่ฏไผฐๅฝๅ็ฏๅข้ ็ฝฎ็ๅฎๅ จๆฐดไฝ
- ๆบ็ ไธญๅถๅฐๆฎ็็กฌ็ผ็ ็ๅฏ้ฅ๏ผๆไธบๅฎๅ จ้ๆฃ็ๅฎๆถ็ธๅผน
- ๅค็ฏๅข๏ผๅผๅใๆต่ฏใ็ไบง๏ผ็้ ็ฝฎ็ฎก็ๆททไนฑ๏ผๅฎนๆ่ฏฏๆไฝ
ๆ ธๅฟไปทๅผ๏ผ ็จไธ่กๅฝไปคๅฎๆ็ฏๅขๅ้็ๅ ๅฏไฟๆค๏ผ็จไธๅฅ่งๅๅฎ็ฐๅฎๅ จๅฎก่ฎก่ชๅจๅ๏ผ็จ้ถไพตๅ ฅ็ๆนๅผ่ๅ ฅ็ฐๆๅผๅๆต็จใ
ๅทฎๅผๅไบฎ็น๏ผ
- ๐ ้ถ้
็ฝฎๅฏๅจ โ ๆ ้ๅคๆ่ฎพ็ฝฎ๏ผ
envshield initๅณๅปไธๆ - โก ๆ่ด่ฝป้ โ ๆ ธๅฟไพ่ตไป
cryptographyใrichใclickไธไธชๅบ - ๐ ๆ ็ผ้ๆ โ Git ้ฉๅญ่ชๅจๆฆๆช๏ผ่ฟ่กๆถ้ๆ่งฃๅฏๆณจๅ ฅ
- ๐ ้ๅๅฎๅ จ โ 15 ๆกๅฎก่ฎก่งๅ่พๅบ 0-100 ๅฎๅ จ่ฏๅ๏ผๅฎๅ จ็ถๅตไธ็ฎไบ็ถ
| ็นๆง | ่ฏดๆ |
|---|---|
| ๐ AES-256-GCM ๅ ๅฏ | ้็จๅไบ็บงๅ ๅฏ็ฎๆณไฟๆค .env ๆไปถ๏ผๆฏๆ่ฎค่ฏๅ ๅฏ๏ผ้ฒ็ฏกๆน |
| ๐ ๅฎๅ จๅฎก่ฎกๅผๆ | ๅ ็ฝฎ 15 ๆกๅฎๅ จ่งๅ๏ผ่พๅบ 0-100 ๅฎๅ จ่ฏๅๅ่ฏฆ็ปๆน่ฟๅปบ่ฎฎ |
| ๐ต๏ธ ๆบ็ ๆซๆๅจ | ๆบ่ฝๆฃๆต 20+ ็ง็กฌ็ผ็ ๅฏ้ฅๆจกๅผ๏ผ่ฆ็ PythonใJSใGoใJava ็ญไธปๆต่ฏญ่จ |
| ๐ช Git ้ฉๅญๅฎๆค | ่ชๅจๅฎ่ฃ
pre-commit ้ฉๅญ๏ผไปๆบๅคด้ปๆญข .env ๆไปถ่ขซๆไบคๅฐไปฃ็ ไปๅบ |
| ๐ ๅค็ฏๅข็ฎก็ | ๆฏๆ dev / staging / prod ๅค็ฏๅข้ ็ฝฎๅๆข๏ผๅๅซ็ฏๅขๆททไนฑ |
| ๐ TUI ๅฏ่งๅไปช่กจ็ | ๅบไบ Rich ๆๅปบ็็ป็ซฏไปช่กจ็๏ผ็ด่งๅฑ็คบๅฎๅ จ็ถๆๆฆ่ง |
| ๐ ่ฟ่กๆถๅ ๅญ่งฃๅฏ | ่งฃๅฏๅ็ๅ้ไป ๅญๅจไบ่ฟ็จๅ ๅญไธญ๏ผไธ่ฝ็๏ผไธ็็ |
| ๐ค ๆ ผๅผๅฏผๅ ฅๅฏผๅบ | ๆฏๆ JSON / YAML ๆ ผๅผๅฏผๅบๅฏผๅ ฅ๏ผๆนไพฟ่ทจๅนณๅฐ่ฟ็งปๅๅคไปฝ |
- Python 3.8 ๆๆด้ซ็ๆฌ
- pip ๅ ็ฎก็ๅจ
# ้่ฟ pip ๅฎ่ฃ
pip install envshield
# ้ช่ฏๅฎ่ฃ
envshield --version# ็ฌฌไธๆญฅ๏ผๅจ้กน็ฎๆ น็ฎๅฝๅๅงๅ
envshield init
# ็ฌฌไบๆญฅ๏ผๅ ๅฏไฝ ็ .env ๆไปถ
envshield encrypt .env
# ็ฌฌไธๆญฅ๏ผ่ฟ่กๅฎๅ
จๅฎก่ฎก๏ผๆฅ็ๅฎๅ
จ่ฏๅ
envshield audit .envๅ ๅฏๅไผ็ๆ .env.vault ๆไปถ๏ผๅๅง .env ๆไปถๅฐ่ขซๅฎๅ
จๅ ้คใไฝ ๅฏไปฅๆพๅฟๅฐๅฐ .env.vault ๆไบคๅฐไปฃ็ ไปๅบใ
# ๅ ๅฏ .env ๆไปถ๏ผ้ป่ฎค๏ผ
envshield encrypt .env
# ๅ ๅฏๆๅฎๆไปถ
envshield encrypt /path/to/production.env
# ่งฃๅฏ .env.vault ๆไปถ
envshield decrypt .env.vault
# ่งฃๅฏๅฐๆๅฎ่พๅบๆไปถ
envshield decrypt .env.vault --output .env.localๅ ๅฏๆต็จ่ฏดๆ๏ผ
- ่ฏปๅๅๅง
.envๆไปถๅ ๅฎน - ไฝฟ็จ AES-256-GCM ็ฎๆณๅ ๅฏ
- ็ๆ
.env.vaultๅ ๅฏๆไปถ - ๅฎๅ
จๆฆ้คๅๅง
.envๆไปถ - ่ชๅจๅฐ
.env.vaultๆทปๅ ๅฐ.gitignore๏ผๅฏ้๏ผ
# ๅฏนๅฝๅ .env ๆไปถ่ฟ่กๅฎก่ฎก
envshield audit .env
# ๅฎก่ฎกๅนถ่พๅบ JSON ๆ ผๅผๆฅๅ
envshield audit .env --format json --output report.json
# ๅฎก่ฎกๆๅฎ็ฎๅฝไธๆๆ .env ๆไปถ
envshield audit ./config/ๅฎก่ฎก่พๅบ็คบไพ๏ผ
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ EnvShield ๅฎๅ
จๅฎก่ฎกๆฅๅ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ ็ปผๅๅฎๅ
จ่ฏๅ: 72 / 100 โ ๏ธ ไธญ็ญ้ฃ้ฉ โ
โ ๅฎก่ฎก่งๅๆฐ: 15 ๆก โ
โ ้่ฟ่งๅ: 11 ๆก โ
โ
โ ่ญฆๅ่งๅ: 3 ๆก โ ๏ธ โ
โ ๆช้่ฟ่งๅ: 1 ๆก โ โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
# ๆซๆๅฝๅ็ฎๅฝ
envshield scan .
# ๆซๆๆๅฎ็ฎๅฝ๏ผๆ้ค node_modules
envshield scan ./src --exclude node_modules,venv,.git
# ๆซๆๅนถ่พๅบ่ฏฆ็ปๆฅๅ
envshield scan ./src --verboseๆบ็ ๆซๆๅจๆฏๆๆฃๆตไปฅไธๆจกๅผ๏ผ
- ็กฌ็ผ็ ็ API Key๏ผ
api_key = "sk-..."๏ผ - ๆฐๆฎๅบ่ฟๆฅๅญ็ฌฆไธฒไธญ็ๆๆๅฏ็
- AWS / GCP / Azure ๅญ่ฏ
- JWT ๅฏ้ฅใOAuth Token
- ็ง้ฅๆไปถๅ ๅฎน
- ๅ ถไป 20+ ็งๅธธ่งๅฏ้ฅๆณ้ฒๆจกๅผ
# ๅฎ่ฃ
pre-commit ้ฉๅญ
envshield hook install
# ๅธ่ฝฝ้ฉๅญ
envshield hook uninstallๅฎ่ฃ
ๅ๏ผๆฏๆฌก git commit ๆถไผ่ชๅจๆฃๆตๆๅญๅบไธญๆฏๅฆๅ
ๅซ .env ๆไปถใๅฆๆๆฃๆตๅฐ๏ผๆไบคๅฐ่ขซ้ปๆญขๅนถๆ็คบ็จๆทใ
# ๆๅผไบคไบๅผไปช่กจ็
envshield dashboardไปช่กจ็ๆไพไปฅไธ่งๅพ๏ผ
- ็ฏๅขๅ้ๆป่ง๏ผๅ ๅฏ/ๆๆ็ถๆ๏ผ
- ๅฎๅ จ่ฏๅ่ถๅฟๅพ
- ๆ่ฟๅฎก่ฎกๅๅฒ
- ๅฏ้ฅ่ฝฎๆขๆ้
# ่ฎพ็ฝฎๅ้
envshield set DATABASE_URL "postgres://user:pass@localhost:5432/mydb"
# ่ทๅๅ้
envshield get DATABASE_URL
# ๅๅบๆๆๅ้
envshield list
# ๅ ้คๅ้
envshield delete API_KEY# ๅๆขๅฐ็ไบง็ฏๅข
envshield switch prod
# ๅๆขๅฐๅผๅ็ฏๅข
envshield switch dev
# ๆฅ็ๅฝๅ็ฏๅข
envshield switch --currentEnvShield ๅ ็ฝฎ 15 ๆกๅฎๅ จๅฎก่ฎก่งๅ๏ผ่ฆ็ๅฏ้ฅๅผบๅบฆใๆไปถๆ้ใๆณ้ฒๆฃๆต็ญๅคไธช็ปดๅบฆ๏ผ
| # | ่งๅๅ็งฐ | ่ฏดๆ | ไธฅ้็บงๅซ |
|---|---|---|---|
| 1 | ๅผฑๅฏ้ฅๆฃๆต | ๆฃๆฅๅฏ้ฅ้ฟๅบฆๆฏๅฆไฝไบ 16 ไธชๅญ็ฌฆ | ๐ด ้ซ |
| 2 | ๅธธ่งๅผฑๅฏ้ฅๅน้ | ๆฃๆตๆฏๅฆไฝฟ็จ passwordใ123456 ็ญๅธธ่งๅผฑๅฏ้ฅ |
๐ด ้ซ |
| 3 | ๅฏ้ฅ็ตๅผ่ฏไผฐ | ่ฏไผฐๅฏ้ฅ็้ๆบๆงๅๅคๆๅบฆ | ๐ก ไธญ |
| 4 | ๆๆๅฏ็ ๆฃๆต | ๆฃๆฅ่ฟๆฅๅญ็ฌฆไธฒไธญๆฏๅฆๅ ๅซๆๆๅฏ็ | ๐ด ้ซ |
| 5 | API Key ๆ ผๅผ้ช่ฏ | ้ช่ฏ API Key ๆฏๅฆ็ฌฆๅๆๅกๅๆ ผๅผ่ง่ | ๐ก ไธญ |
| 6 | ่ฟๆๅฏ้ฅๆฃๆต | ๆฃๆฅๅฏ้ฅๆฏๅฆ่ถ ่ฟๅปบ่ฎฎ่ฝฎๆขๅจๆ๏ผ90 ๅคฉ๏ผ | ๐ก ไธญ |
| 7 | ๆไปถๆ้ๆฃๆฅ | ๆฃๆฅ .env ๆไปถๆ้ๆฏๅฆ่ฟไบๅฎฝๆพ |
๐ด ้ซ |
| 8 | .gitignore ่ฆ็ๆฃๆฅ | ็กฎ่ฎค .env ๆไปถๅทฒ่ขซ .gitignore ๆ้ค |
๐ด ้ซ |
| 9 | ้ๅคๅฏ้ฅๆฃๆต | ๆฃๆฅไธๅ็ฏๅข้ดๆฏๅฆๅญๅจ็ธๅๅฏ้ฅ | ๐ก ไธญ |
| 10 | ๆๆๅ้ๅฝๅ่ง่ | ๆฃๆฅๆๆๅ้ๆฏๅฆไฝฟ็จ SECRETใKEYใTOKEN ็ญๅ็ผ |
๐ข ไฝ |
| 11 | ็กฌ็ผ็ ๅญ่ฏๆซๆ | ๆซๆๆบ็ ไธญๆฏๅฆๅญๅจ็กฌ็ผ็ ็ๅญ่ฏ | ๐ด ้ซ |
| 12 | ่ฐ่ฏๆจกๅผๆฃๆต | ๆฃๆฅๆฏๅฆๅจ็ไบง็ฏๅขๅผๅฏไบ่ฐ่ฏๆจกๅผ | ๐ก ไธญ |
| 13 | ไธๅฎๅ จๅ่ฎฎๆฃๆต | ๆฃๆฅ่ฟๆฅๅญ็ฌฆไธฒๆฏๅฆไฝฟ็จ HTTP ็ญไธๅฎๅ จๅ่ฎฎ | ๐ก ไธญ |
| 14 | ้ป่ฎคๅญ่ฏๆฃๆต | ๆฃๆฅๆฏๅฆไฝฟ็จไบๆกๆถ้ป่ฎคๅญ่ฏ | ๐ด ้ซ |
| 15 | ๅฏ้ฅ่ฝฎๆข็ญ็ฅ | ่ฏไผฐๅฏ้ฅ่ฝฎๆข็ญ็ฅ็ๅฎๅ็จๅบฆ | ๐ข ไฝ |
# ๅๅงๅๅค็ฏๅข้
็ฝฎ
envshield init --envs dev,staging,prod
# ไธบไธๅ็ฏๅข่ฎพ็ฝฎๅ้
envshield set DATABASE_URL "postgres://localhost/dev" --env dev
envshield set DATABASE_URL "postgres://staging-db/app" --env staging
envshield set DATABASE_URL "postgres://prod-db/app" --env prod
# ๅๆข็ฏๅข
envshield switch prod# ไฝฟ็จ่ฟ่กๆถๆณจๅ
ฅๅฏๅจๅบ็จ
envshield run -- python app.py
# ไฝฟ็จ่ฟ่กๆถๆณจๅ
ฅๅฏๅจ Node.js ๅบ็จ
envshield run -- node server.js
# ไฝฟ็จ่ฟ่กๆถๆณจๅ
ฅๆง่กไปปๆๅฝไปค
envshield run -- make deploy่ฟ่กๆถๆณจๅ ฅ็ๅทฅไฝๅ็๏ผ
- ่ฏปๅ
.env.vaultๅ ๅฏๆไปถ - ๅจ่ฟ็จๅ ๅญไธญ่งฃๅฏ
- ๅฐ่งฃๅฏๅ็ๅ้ๆณจๅ ฅๅฐๅญ่ฟ็จ็็ฏๅขๅ้ไธญ
- ่งฃๅฏๆฐๆฎไป ๅญๅจไบๅ ๅญไธญ๏ผ่ฟ็จ็ปๆๅ่ชๅจๆธ ้ค
# GitHub Actions ็คบไพ
- name: Setup EnvShield
run: pip install envshield
- name: Decrypt environment
run: envshield decrypt .env.vault --output .env
env:
ENVSHIELD_MASTER_KEY: ${{ secrets.ENVSHIELD_MASTER_KEY }}
- name: Run security audit
run: envshield audit .env --format json --output audit-report.json
- name: Scan source code
run: envshield scan ./src --exclude node_modules,venv# GitLab CI ็คบไพ
security_audit:
stage: test
before_script:
- pip install envshield
script:
- envshield decrypt .env.vault --output .env
- envshield audit .env
- envshield scan ./src
artifacts:
reports:
security_audit: audit-report.json# ๅฏผๅบไธบ JSON ๆ ผๅผ
envshield export --format json --output config.json
# ๅฏผๅบไธบ YAML ๆ ผๅผ
envshield export --format yaml --output config.yaml
# ไป JSON ๅฏผๅ
ฅ
envshield import config.json
# ไป YAML ๅฏผๅ
ฅ
envshield import config.yamlๆไปฌๆฌข่ฟๅนถๆ่ฐขๆฏไธไฝ่ดก็ฎ่ ๏ผๅจๅไธ่ดก็ฎไนๅ๏ผ่ฏท้ ่ฏปไปฅไธ่ง่๏ผ
- Fork ๆฌไปๅบๅนถๅๅปบไฝ ็็นๆงๅๆฏ๏ผ
git checkout -b feature/amazing-feature - ็ผๅไปฃ็ ๅนถ็กฎไฟ้่ฟๆๆๆต่ฏ๏ผ
pytest tests/ - ๆไบคๅๆด๏ผไฝฟ็จ Conventional Commits ่ง่๏ผ
git commit -m 'feat: add amazing feature' - ๆจ้ ๅฐไฝ ็ Fork๏ผ
git push origin feature/amazing-feature - ๅๅปบ Pull Request ๅนถ่ฏฆ็ปๆ่ฟฐๅๆดๅ ๅฎน
- ไฝฟ็จๆธ ๆฐ็ๆ ้ขๆ่ฟฐ้ฎ้ข
- ้ไธๅค็ฐๆญฅ้ชคๅๆๆ่กไธบ
- ้ไธ่ฟ่ก็ฏๅขไฟกๆฏ๏ผๆไฝ็ณป็ปใPython ็ๆฌใEnvShield ็ๆฌ๏ผ
- ๅฆๆๅฏ่ฝ๏ผ้ไธ้่ฏฏๆฅๅฟๆชๅพ
- ้ตๅพช PEP 8 ็ผ็ ่ง่
- ๆๆๅ ฌๅ ฑๅฝๆฐๅฟ ้กปๅ ๅซๆๆกฃๅญ็ฌฆไธฒ
- ๆฐๅ่ฝๅฟ ้กป้ๅธฆๅฏนๅบ็ๅๅ ๆต่ฏ
- ๅฎๅ จ็ธๅ ณไปฃ็ ๅๆด้่ฆ็ป่ฟ้ขๅค็ไปฃ็ ๅฎกๆฅ
ๆฌ้กน็ฎๅบไบ MIT ๅ่ฎฎ ๅผๆบใ
MIT License
Copyright (c) 2024 EnvShield Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EnvShield ๆฏไธๆฌพ่ผ้็ด็ฐๅข่ฎๆธๅฎๅ จ็ฎก็ CLI ๅผๆ๏ผๅฐ็บไฟ่ญทๆ็จ็จๅผๆๆ่จญๅฎ่่จญ่จใ
็บไป้บผ้่ฆ EnvShield๏ผ
ๅจๆฅๅธธ้็ผไธญ๏ผๆๅ็ถๅธธ้ข่จไปฅไธ็้ป๏ผ
.envๆชๆกไปฅๆๆๅฒๅญๅจๅฐๆก็ฎ้ไธญ๏ผไปปไฝๆๆ็จๅผ็ขผๅญๅๆฌ้็ไบบ้ฝ่ฝ็ๅฐ่ณๆๅบซๅฏ็ขผใAPI ้้ฐ็ญๆๆ่ณ่จ- ๅ้ๅไฝๆ๏ผ้้ฐ้้้่จ่ป้ซๆ้ปๅญ้ตไปถๅณ้๏ผๅญๅจๅคๆดฉ้ขจ้ช
- ็ผบไน็ณป็ตฑๅ็ๅฎๅ จ็จฝๆ ธๆๆฎต๏ผ้ฃไปฅ่ฉไผฐ็ฎๅ็ฐๅข่จญๅฎ็ๅฎๅ จๆฐดไฝ
- ๅๅง็ขผไธญๅถ็พๆฎ็็กฌ็ทจ็ขผ็้้ฐ๏ผๆ็บๅฎๅ จ้ฑๆฃ็ๅฎๆ็ธๅฝ
- ๅค็ฐๅข๏ผ้็ผใๆธฌ่ฉฆใๆญฃๅผ๏ผ็่จญๅฎ็ฎก็ๆททไบ๏ผๅฎนๆ่ชคๆไฝ
ๆ ธๅฟๅนๅผ๏ผ ็จไธ่กๆไปคๅฎๆ็ฐๅข่ฎๆธ็ๅ ๅฏไฟ่ญท๏ผ็จไธๅฅ่ฆๅๅฏฆ็พๅฎๅ จ็จฝๆ ธ่ชๅๅ๏ผ็จ้ถไพตๅ ฅ็ๆนๅผ่ๅ ฅ็พๆ้็ผๆต็จใ
ๅทฎ็ฐๅไบฎ้ป๏ผ
- ๐ ้ถ่จญๅฎๅๅ โ ็ก้็น็ฃ่จญๅฎ๏ผ
envshield initๅณๅปไธๆ - โก ๆฅต่ด่ผ้ โ ๆ ธๅฟไพ่ณดๅ
cryptographyใrichใclickไธๅๅฝๅผๅบซ - ๐ ็ก็ธซๆดๅ โ Git ๆๆชๅจ่ชๅ้ฒ่ญท๏ผๅท่กๆ้ๆ่งฃๅฏๆณจๅ ฅ
- ๐ ้ๅๅฎๅ จ โ 15 ๆข็จฝๆ ธ่ฆๅ่ผธๅบ 0-100 ๅฎๅ จ่ฉๅ๏ผๅฎๅ จ็ๆณไธ็ฎ็ญ็ถ
| ็นๆง | ่ชชๆ |
|---|---|
| ๐ AES-256-GCM ๅ ๅฏ | ๆก็จ่ปไบ็ดๅ ๅฏๆผ็ฎๆณไฟ่ญท .env ๆชๆก๏ผๆฏๆด่ช่ญๅ ๅฏ๏ผ้ฒ็ซๆน |
| ๐ ๅฎๅ จ็จฝๆ ธๅผๆ | ๅ งๅปบ 15 ๆขๅฎๅ จ่ฆๅ๏ผ่ผธๅบ 0-100 ๅฎๅ จ่ฉๅๅ่ฉณ็ดฐๆนๅๅปบ่ญฐ |
| ๐ต๏ธ ๅๅง็ขผๆๆๅจ | ๆบๆ งๅตๆธฌ 20+ ็จฎ็กฌ็ทจ็ขผ้้ฐๆจกๅผ๏ผๆถต่ PythonใJSใGoใJava ็ญไธปๆต่ช่จ |
| ๐ช Git ๆๆชๅจๅฎ่ญท | ่ชๅๅฎ่ฃ pre-commit ๆๆชๅจ๏ผๅพๆบ้ ญ้ปๆญข .env ๆชๆก่ขซๆไบคๅฐ็จๅผ็ขผๅๅบซ |
| ๐ ๅค็ฐๅข็ฎก็ | ๆฏๆด dev / staging / prod ๅค็ฐๅข่จญๅฎๅๆ๏ผๅๅฅ็ฐๅขๆททไบ |
| ๐ TUI ่ฆ่ฆบๅๅ่กจๆฟ | ๅบๆผ Rich ๅปบๆง็็ต็ซฏๅ่กจๆฟ๏ผ็ด่งๅฑ็คบๅฎๅ จ็ๆ ็ธฝ่ฆฝ |
| ๐ ๅท่กๆ่จๆถ้ซ่งฃๅฏ | ่งฃๅฏๅพ็่ฎๆธๅ ๅญๅจๆผ่ก็จ่จๆถ้ซไธญ๏ผไธ่ฝ็ข๏ผไธ็็ |
| ๐ค ๆ ผๅผๅฏๅ ฅๅฏๅบ | ๆฏๆด JSON / YAML ๆ ผๅผๅฏๅบๅฏๅ ฅ๏ผๆนไพฟ่ทจๅนณๅฐ้ท็งป่ๅไปฝ |
- Python 3.8 ๆๆด้ซ็ๆฌ
- pip ๅฅไปถ็ฎก็ๅจ
# ้้ pip ๅฎ่ฃ
pip install envshield
# ้ฉ่ญๅฎ่ฃ
envshield --version# ็ฌฌไธๆญฅ๏ผๅจๅฐๆกๆ น็ฎ้ๅๅงๅ
envshield init
# ็ฌฌไบๆญฅ๏ผๅ ๅฏไฝ ็ .env ๆชๆก
envshield encrypt .env
# ็ฌฌไธๆญฅ๏ผๅท่กๅฎๅ
จ็จฝๆ ธ๏ผๆฅ็ๅฎๅ
จ่ฉๅ
envshield audit .envๅ ๅฏๅพๆ็ข็ .env.vault ๆชๆก๏ผๅๅง .env ๆชๆกๅฐ่ขซๅฎๅ
จๅช้คใไฝ ๅฏไปฅๆพๅฟๅฐๅฐ .env.vault ๆไบคๅฐ็จๅผ็ขผๅๅบซใ
# ๅ ๅฏ .env ๆชๆก๏ผ้ ่จญ๏ผ
envshield encrypt .env
# ๅ ๅฏๆๅฎๆชๆก
envshield encrypt /path/to/production.env
# ่งฃๅฏ .env.vault ๆชๆก
envshield decrypt .env.vault
# ่งฃๅฏๅฐๆๅฎ่ผธๅบๆชๆก
envshield decrypt .env.vault --output .env.localๅ ๅฏๆต็จ่ชชๆ๏ผ
- ่ฎๅๅๅง
.envๆชๆกๅ งๅฎน - ไฝฟ็จ AES-256-GCM ๆผ็ฎๆณๅ ๅฏ
- ็ข็
.env.vaultๅ ๅฏๆชๆก - ๅฎๅ
จๆธ
้คๅๅง
.envๆชๆก - ่ชๅๅฐ
.env.vaultๅ ๅ ฅ.gitignore๏ผๅฏ้ธ๏ผ
# ๅฐ็ฎๅ .env ๆชๆก้ฒ่ก็จฝๆ ธ
envshield audit .env
# ็จฝๆ ธไธฆ่ผธๅบ JSON ๆ ผๅผๅ ฑๅ
envshield audit .env --format json --output report.json
# ็จฝๆ ธๆๅฎ็ฎ้ไธๆๆ .env ๆชๆก
envshield audit ./config/็จฝๆ ธ่ผธๅบ็ฏไพ๏ผ
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ EnvShield ๅฎๅ
จ็จฝๆ ธๅ ฑๅ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ ็ถๅๅฎๅ
จ่ฉๅ: 72 / 100 โ ๏ธ ไธญ็ญ้ขจ้ช โ
โ ็จฝๆ ธ่ฆๅๆธ: 15 ๆข โ
โ ้้่ฆๅ: 11 ๆข โ
โ
โ ่ญฆๅ่ฆๅ: 3 ๆข โ ๏ธ โ
โ ๆช้้่ฆๅ: 1 ๆข โ โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
# ๆๆ็ฎๅ็ฎ้
envshield scan .
# ๆๆๆๅฎ็ฎ้๏ผๆ้ค node_modules
envshield scan ./src --exclude node_modules,venv,.git
# ๆๆไธฆ่ผธๅบ่ฉณ็ดฐๅ ฑๅ
envshield scan ./src --verboseๅๅง็ขผๆๆๅจๆฏๆดๅตๆธฌไปฅไธๆจกๅผ๏ผ
- ็กฌ็ทจ็ขผ็ API Key๏ผ
api_key = "sk-..."๏ผ - ่ณๆๅบซ้ฃ็ทๅญไธฒไธญ็ๆๆๅฏ็ขผ
- AWS / GCP / Azure ๆ่ญ
- JWT ้้ฐใOAuth Token
- ็ง้ฐๆชๆกๅ งๅฎน
- ๅ ถไป 20+ ็จฎๅธธ่ฆ้้ฐๅคๆดฉๆจกๅผ
# ๅฎ่ฃ pre-commit ๆๆชๅจ
envshield hook install
# ๅธ่ผๆๆชๅจ
envshield hook uninstallๅฎ่ฃๅพ๏ผๆฏๆฌก git commit ๆๆ่ชๅๅตๆธฌๆซๅญๅไธญๆฏๅฆๅ
ๅซ .env ๆชๆกใๅฆๆๅตๆธฌๅฐ๏ผๆไบคๅฐ่ขซ้ปๆญขไธฆๆ็คบไฝฟ็จ่
ใ
# ้ๅไบๅๅผๅ่กจๆฟ
envshield dashboardๅ่กจๆฟๆไพไปฅไธๆชข่ฆ๏ผ
- ็ฐๅข่ฎๆธ็ธฝ่ฆฝ๏ผๅ ๅฏ/ๆๆ็ๆ ๏ผ
- ๅฎๅ จ่ฉๅ่ถจๅขๅ
- ๆ่ฟ็จฝๆ ธๆญทๅฒ
- ้้ฐ่ผชๆๆ้
# ่จญๅฎ่ฎๆธ
envshield set DATABASE_URL "postgres://user:pass@localhost:5432/mydb"
# ๅๅพ่ฎๆธ
envshield get DATABASE_URL
# ๅๅบๆๆ่ฎๆธ
envshield list
# ๅช้ค่ฎๆธ
envshield delete API_KEY# ๅๆๅฐๆญฃๅผ็ฐๅข
envshield switch prod
# ๅๆๅฐ้็ผ็ฐๅข
envshield switch dev
# ๆฅ็็ฎๅ็ฐๅข
envshield switch --currentEnvShield ๅ งๅปบ 15 ๆขๅฎๅ จ็จฝๆ ธ่ฆๅ๏ผๆถต่้้ฐๅผทๅบฆใๆชๆกๆฌ้ใๅคๆดฉๅตๆธฌ็ญๅคๅ็ถญๅบฆ๏ผ
| # | ่ฆๅๅ็จฑ | ่ชชๆ | ๅด้็ญ็ด |
|---|---|---|---|
| 1 | ๅผฑ้้ฐๅตๆธฌ | ๆชขๆฅ้้ฐ้ทๅบฆๆฏๅฆไฝๆผ 16 ๅๅญๅ | ๐ด ้ซ |
| 2 | ๅธธ่ฆๅผฑ้้ฐๆฏๅฐ | ๅตๆธฌๆฏๅฆไฝฟ็จ passwordใ123456 ็ญๅธธ่ฆๅผฑ้้ฐ |
๐ด ้ซ |
| 3 | ้้ฐ็ตๅผ่ฉไผฐ | ่ฉไผฐ้้ฐ็้จๆฉๆง่่ค้ๅบฆ | ๐ก ไธญ |
| 4 | ๆๆๅฏ็ขผๅตๆธฌ | ๆชขๆฅ้ฃ็ทๅญไธฒไธญๆฏๅฆๅ ๅซๆๆๅฏ็ขผ | ๐ด ้ซ |
| 5 | API Key ๆ ผๅผ้ฉ่ญ | ้ฉ่ญ API Key ๆฏๅฆ็ฌฆๅๆๅๅๆ ผๅผ่ฆ็ฏ | ๐ก ไธญ |
| 6 | ้ๆ้้ฐๅตๆธฌ | ๆชขๆฅ้้ฐๆฏๅฆ่ถ ้ๅปบ่ญฐ่ผชๆ้ฑๆ๏ผ90 ๅคฉ๏ผ | ๐ก ไธญ |
| 7 | ๆชๆกๆฌ้ๆชขๆฅ | ๆชขๆฅ .env ๆชๆกๆฌ้ๆฏๅฆ้ๆผๅฏฌ้ฌ |
๐ด ้ซ |
| 8 | .gitignore ่ฆ่ๆชขๆฅ | ็ขบ่ช .env ๆชๆกๅทฒ่ขซ .gitignore ๆ้ค |
๐ด ้ซ |
| 9 | ้่ค้้ฐๅตๆธฌ | ๆชขๆฅไธๅ็ฐๅข้ๆฏๅฆๅญๅจ็ธๅ้้ฐ | ๐ก ไธญ |
| 10 | ๆๆ่ฎๆธๅฝๅ่ฆ็ฏ | ๆชขๆฅๆๆ่ฎๆธๆฏๅฆไฝฟ็จ SECRETใKEYใTOKEN ็ญๅพ็ถด |
๐ข ไฝ |
| 11 | ็กฌ็ทจ็ขผๆ่ญๆๆ | ๆๆๅๅง็ขผไธญๆฏๅฆๅญๅจ็กฌ็ทจ็ขผ็ๆ่ญ | ๐ด ้ซ |
| 12 | ้ค้ฏๆจกๅผๅตๆธฌ | ๆชขๆฅๆฏๅฆๅจๆญฃๅผ็ฐๅข้ๅไบ้ค้ฏๆจกๅผ | ๐ก ไธญ |
| 13 | ไธๅฎๅ จๅๅฎๅตๆธฌ | ๆฃขๆฅ้ฃ็ทๅญไธฒๆฏๅฆไฝฟ็จ HTTP ็ญไธๅฎๅ จๅๅฎ | ๐ก ไธญ |
| 14 | ้ ่จญๆ่ญๅตๆธฌ | ๆชขๆฅๆฏๅฆไฝฟ็จไบๆกๆถ้ ่จญๆ่ญ | ๐ด ้ซ |
| 15 | ้้ฐ่ผชๆ็ญ็ฅ | ่ฉไผฐ้้ฐ่ผชๆ็ญ็ฅ็ๅฎๅ็จๅบฆ | ๐ข ไฝ |
# ๅๅงๅๅค็ฐๅข่จญๅฎ
envshield init --envs dev,staging,prod
# ็บไธๅ็ฐๅข่จญๅฎ่ฎๆธ
envshield set DATABASE_URL "postgres://localhost/dev" --env dev
envshield set DATABASE_URL "postgres://staging-db/app" --env staging
envshield set DATABASE_URL "postgres://prod-db/app" --env prod
# ๅๆ็ฐๅข
envshield switch prod# ไฝฟ็จๅท่กๆๆณจๅ
ฅๅๅๆ็จ็จๅผ
envshield run -- python app.py
# ไฝฟ็จๅท่กๆๆณจๅ
ฅๅๅ Node.js ๆ็จ็จๅผ
envshield run -- node server.js
# ไฝฟ็จๅท่กๆๆณจๅ
ฅๅท่กไปปๆๆไปค
envshield run -- make deployๅท่กๆๆณจๅ ฅ็ๅทฅไฝๅ็๏ผ
- ่ฎๅ
.env.vaultๅ ๅฏๆชๆก - ๅจ่ก็จ่จๆถ้ซไธญ่งฃๅฏ
- ๅฐ่งฃๅฏๅพ็่ฎๆธๆณจๅ ฅๅฐๅญ่ก็จ็็ฐๅข่ฎๆธไธญ
- ่งฃๅฏ่ณๆๅ ๅญๅจๆผ่จๆถ้ซไธญ๏ผ่ก็จ็ตๆๅพ่ชๅๆธ ้ค
# GitHub Actions ็ฏไพ
- name: Setup EnvShield
run: pip install envshield
- name: Decrypt environment
run: envshield decrypt .env.vault --output .env
env:
ENVSHIELD_MASTER_KEY: ${{ secrets.ENVSHIELD_MASTER_KEY }}
- name: Run security audit
run: envshield audit .env --format json --output audit-report.json
- name: Scan source code
run: envshield scan ./src --exclude node_modules,venv# GitLab CI ็ฏไพ
security_audit:
stage: test
before_script:
- pip install envshield
script:
- envshield decrypt .env.vault --output .env
- envshield audit .env
- envshield scan ./src
artifacts:
reports:
security_audit: audit-report.json# ๅฏๅบ็บ JSON ๆ ผๅผ
envshield export --format json --output config.json
# ๅฏๅบ็บ YAML ๆ ผๅผ
envshield export --format yaml --output config.yaml
# ๅพ JSON ๅฏๅ
ฅ
envshield import config.json
# ๅพ YAML ๅฏๅ
ฅ
envshield import config.yamlๆๅๆญก่ฟไธฆๆ่ฌๆฏไธไฝ่ฒข็ป่ ๏ผๅจๅ่่ฒข็ปไนๅ๏ผ่ซ้ฑ่ฎไปฅไธ่ฆ็ฏ๏ผ
- Fork ๆฌๅๅบซไธฆๅปบ็ซไฝ ็ๅ่ฝๅๆฏ๏ผ
git checkout -b feature/amazing-feature - ๆฐๅฏซ็จๅผ็ขผ ไธฆ็ขบไฟ้้ๆๆๆธฌ่ฉฆ๏ผ
pytest tests/ - ๆไบค่ฎๆด๏ผไฝฟ็จ Conventional Commits ่ฆ็ฏ๏ผ
git commit -m 'feat: add amazing feature' - ๆจ้ ๅฐไฝ ็ Fork๏ผ
git push origin feature/amazing-feature - ๅปบ็ซ Pull Request ไธฆ่ฉณ็ดฐๆ่ฟฐ่ฎๆดๅ งๅฎน
- ไฝฟ็จๆธ ๆฐ็ๆจ้กๆ่ฟฐๅ้ก
- ้ไธ้็พๆญฅ้ฉ่ๆๆ่ก็บ
- ้ไธๅท่ก็ฐๅข่ณ่จ๏ผไฝๆฅญ็ณป็ตฑใPython ็ๆฌใEnvShield ็ๆฌ๏ผ
- ๅฆๆๅฏ่ฝ๏ผ้ไธ้ฏ่ชคๆฅ่ชๆชๅ
- ้ตๅพช PEP 8 ็ทจ็ขผ่ฆ็ฏ
- ๆๆๅ ฌๅ ฑๅฝๅผๅฟ ้ ๅ ๅซๆไปถๅญไธฒ
- ๆฐๅ่ฝๅฟ ้ ้ๅธถๅฐๆ็ๅฎๅ ๆธฌ่ฉฆ
- ๅฎๅ จ็ธ้็จๅผ็ขผ่ฎๆด้่ฆ็ถ้้กๅค็็จๅผ็ขผๅฏฉๆฅ
ๆฌๅฐๆกๅบๆผ MIT ๆๆฌ ้ๆบใ
MIT License
Copyright (c) 2024 EnvShield Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EnvShield is a lightweight environment variable security management CLI engine designed to protect sensitive application configurations.
Why EnvShield?
In day-to-day development, we frequently encounter the following pain points:
.envfiles are stored in plaintext within project directories, exposing database passwords, API keys, and other sensitive information to anyone with code access- During team collaboration, secrets are shared via messaging apps or email, creating leakage risks
- There is a lack of systematic security auditing, making it difficult to assess the security posture of environment configurations
- Hardcoded secrets occasionally remain in source code, acting as ticking time bombs for security breaches
- Multi-environment (development, staging, production) configuration management is chaotic and error-prone
Core Value: Encrypt environment variables with a single command, automate security auditing with a comprehensive rule set, and seamlessly integrate into existing development workflows with zero intrusion.
Key Differentiators:
- ๐ Zero-config startup โ No complex setup required; get started instantly with
envshield init - โก Ultra-lightweight โ Only three core dependencies:
cryptography,rich, andclick - ๐ Seamless integration โ Git hooks for automatic interception, transparent runtime decryption injection
- ๐ Quantified security โ 15 auditing rules output a 0-100 security score for at-a-glance assessment
| Feature | Description |
|---|---|
| ๐ AES-256-GCM Encryption | Military-grade authenticated encryption for .env files with tamper protection |
| ๐ Security Audit Engine | 15 built-in security rules with a 0-100 security score and actionable improvement suggestions |
| ๐ต๏ธ Source Code Scanner | Intelligent detection of 20+ hardcoded secret patterns across Python, JS, Go, Java, and more |
| ๐ช Git Hook Guardian | Automatically installed pre-commit hooks prevent .env files from being committed to repositories |
| ๐ Multi-environment Management | Switch between dev / staging / prod configurations effortlessly |
| ๐ TUI Visual Dashboard | Rich-based terminal dashboard for an intuitive overview of your security posture |
| ๐ Runtime In-memory Decryption | Decrypted variables exist only in process memory โ never written to disk |
| ๐ค Format Import/Export | JSON / YAML format support for cross-platform migration and backup |
- Python 3.8 or later
- pip package manager
# Install via pip
pip install envshield
# Verify installation
envshield --version# Step 1: Initialize in your project root
envshield init
# Step 2: Encrypt your .env file
envshield encrypt .env
# Step 3: Run a security audit and check your score
envshield audit .envAfter encryption, a .env.vault file is generated and the original .env file is securely deleted. You can safely commit .env.vault to your repository.
# Encrypt .env file (default)
envshield encrypt .env
# Encrypt a specific file
envshield encrypt /path/to/production.env
# Decrypt .env.vault file
envshield decrypt .env.vault
# Decrypt to a specific output file
envshield decrypt .env.vault --output .env.localEncryption workflow:
- Read the original
.envfile contents - Encrypt using the AES-256-GCM algorithm
- Generate a
.env.vaultencrypted file - Securely erase the original
.envfile - Automatically add
.env.vaultto.gitignore(optional)
# Audit the current .env file
envshield audit .env
# Audit and output a JSON report
envshield audit .env --format json --output report.json
# Audit all .env files in a directory
envshield audit ./config/Sample audit output:
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ EnvShield Security Audit Report โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ Overall Score: 72 / 100 โ ๏ธ Medium Risk โ
โ Rules Checked: 15 โ
โ Passed: 11 โ
โ
โ Warnings: 3 โ ๏ธ โ
โ Failed: 1 โ โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
# Scan the current directory
envshield scan .
# Scan a specific directory, excluding node_modules
envshield scan ./src --exclude node_modules,venv,.git
# Scan with verbose output
envshield scan ./src --verboseThe source code scanner detects the following patterns:
- Hardcoded API keys (
api_key = "sk-...") - Plaintext passwords in database connection strings
- AWS / GCP / Azure credentials
- JWT secrets, OAuth tokens
- Private key file contents
- 20+ other common secret leakage patterns
# Install pre-commit hook
envshield hook install
# Uninstall hook
envshield hook uninstallOnce installed, every git commit automatically checks the staging area for .env files. If detected, the commit is blocked and the user is notified.
# Open the interactive dashboard
envshield dashboardThe dashboard provides the following views:
- Environment variable overview (encrypted/plaintext status)
- Security score trend chart
- Recent audit history
- Key rotation reminders
# Set a variable
envshield set DATABASE_URL "postgres://user:pass@localhost:5432/mydb"
# Get a variable
envshield get DATABASE_URL
# List all variables
envshield list
# Delete a variable
envshield delete API_KEY# Switch to production environment
envshield switch prod
# Switch to development environment
envshield switch dev
# View current environment
envshield switch --currentEnvShield includes 15 built-in security audit rules covering key strength, file permissions, leakage detection, and more:
| # | Rule | Description | Severity |
|---|---|---|---|
| 1 | Weak Key Detection | Checks if key length is below 16 characters | ๐ด High |
| 2 | Common Weak Key Match | Detects use of password, 123456, and other common weak keys |
๐ด High |
| 3 | Key Entropy Evaluation | Evaluates the randomness and complexity of keys | ๐ก Medium |
| 4 | Plaintext Password Detection | Checks for plaintext passwords in connection strings | ๐ด High |
| 5 | API Key Format Validation | Validates API keys against provider format specifications | ๐ก Medium |
| 6 | Expired Key Detection | Checks if keys exceed the recommended rotation period (90 days) | ๐ก Medium |
| 7 | File Permission Check | Checks if .env file permissions are too permissive |
๐ด High |
| 8 | .gitignore Coverage Check | Confirms .env files are excluded in .gitignore |
๐ด High |
| 9 | Duplicate Key Detection | Checks for identical keys across different environments | ๐ก Medium |
| 10 | Sensitive Variable Naming | Checks if sensitive variables use SECRET, KEY, TOKEN suffixes |
๐ข Low |
| 11 | Hardcoded Credential Scan | Scans source code for hardcoded credentials | ๐ด High |
| 12 | Debug Mode Detection | Checks if debug mode is enabled in production | ๐ก Medium |
| 13 | Insecure Protocol Detection | Checks for insecure protocols like HTTP in connection strings | ๐ก Medium |
| 14 | Default Credential Detection | Checks for framework default credentials | ๐ด High |
| 15 | Key Rotation Policy | Evaluates the completeness of key rotation policies | ๐ข Low |
# Initialize multi-environment configuration
envshield init --envs dev,staging,prod
# Set variables for different environments
envshield set DATABASE_URL "postgres://localhost/dev" --env dev
envshield set DATABASE_URL "postgres://staging-db/app" --env staging
envshield set DATABASE_URL "postgres://prod-db/app" --env prod
# Switch environment
envshield switch prod# Start a Python app with runtime injection
envshield run -- python app.py
# Start a Node.js app with runtime injection
envshield run -- node server.js
# Run any command with runtime injection
envshield run -- make deployHow runtime injection works:
- Reads the
.env.vaultencrypted file - Decrypts it in process memory
- Injects the decrypted variables into the child process environment
- Decrypted data exists only in memory and is automatically cleared when the process exits
# GitHub Actions example
- name: Setup EnvShield
run: pip install envshield
- name: Decrypt environment
run: envshield decrypt .env.vault --output .env
env:
ENVSHIELD_MASTER_KEY: ${{ secrets.ENVSHIELD_MASTER_KEY }}
- name: Run security audit
run: envshield audit .env --format json --output audit-report.json
- name: Scan source code
run: envshield scan ./src --exclude node_modules,venv# GitLab CI example
security_audit:
stage: test
before_script:
- pip install envshield
script:
- envshield decrypt .env.vault --output .env
- envshield audit .env
- envshield scan ./src
artifacts:
reports:
security_audit: audit-report.json# Export as JSON format
envshield export --format json --output config.json
# Export as YAML format
envshield export --format yaml --output config.yaml
# Import from JSON
envshield import config.json
# Import from YAML
envshield import config.yamlWe welcome and appreciate every contributor! Before participating, please read the following guidelines:
- Fork this repository and create your feature branch:
git checkout -b feature/amazing-feature - Write code and ensure all tests pass:
pytest tests/ - Commit changes following the Conventional Commits specification:
git commit -m 'feat: add amazing feature' - Push to your fork:
git push origin feature/amazing-feature - Open a Pull Request with a detailed description of your changes
- Use a clear and descriptive title
- Include steps to reproduce and expected behavior
- Include your runtime environment (OS, Python version, EnvShield version)
- Attach error log screenshots when possible
- Follow PEP 8 coding conventions
- All public functions must include docstrings
- New features must include corresponding unit tests
- Security-related code changes require additional code review
This project is licensed under the MIT License.
MIT License
Copyright (c) 2024 EnvShield Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.