CriptEnv

---

🔐 What is CriptEnv?

CriptEnv is a secret management platform built for developers who need to securely store, share, and sync environment variables, API keys, and sensitive credentials across teams and infrastructure.

Unlike traditional secret managers, CriptEnv uses Zero-Knowledge Encryption: your secrets are encrypted on your device with AES-256-GCM before ever reaching our servers. We store only opaque encrypted blobs — we cannot read your secrets, even if we wanted to.

The Problem

Your secrets are scattered everywhere:

• .env files on multiple machines, accidentally committed to Git
• Plain-text messages in Slack, Email, or WhatsApp
• Hosting dashboards (Vercel, Render) without central control
• Personal notes and generic password managers

75% of data breaches involve exposed credentials. CriptEnv solves this with a unified, encrypted vault that stays under your control.

How It Works

Your Device                          CriptEnv Servers
───────────                          ───────────────
┌─────────────┐    Encrypted Blob    ┌─────────────┐
│  Password   │ ──────────────────►  │   Vault     │
│     │       │                      │   Storage   │
│     ▼       │                      │             │
│  PBKDF2     │                      │  (We can    │
│     │       │                      │   NEVER     │
│     ▼       │                      │  decrypt    │
│  AES-256    │    Encrypted Blob    │   this)     │
│  Encrypt    │ ◄──────────────────  │             │
└─────────────┘                      └─────────────┘

1. You enter the project's Vault password on your device
2. Secrets are encrypted with AES-256-GCM using a key derived from that password
3. Only the encrypted blob is sent to our servers
4. Decryption happens in memory inside the CLI or web app, never on the server

---

🚀 Quick Start

Install the CLI

pip install criptenv

Requires Python 3.10+.

Login

# Authenticate with your account
criptenv login --email [email protected]

criptenv init is optional and only prepares local CLI metadata under ~/.criptenv/.

Manage Secrets

# Add a secret to the remote project vault (encrypted locally before sending)
criptenv set DATABASE_URL=postgres://localhost/mydb
criptenv set API_KEY=your_api_key_here

# List all secrets (names only — values are never exposed)
criptenv list

# Get a decrypted value
criptenv get DATABASE_URL

# Import from an existing .env file
criptenv import .env

# Export to .env
criptenv export -o .env.production

Import / Export Files

# Import a .env file into the remote vault
criptenv push .env.production -p my-project

# Export the remote vault to a local .env file
criptenv pull -p my-project --output .env.production

Full Command Reference

Command	Description
criptenv init	Prepare local CLI metadata (optional)
criptenv login	Sign in to your CriptEnv account
criptenv set KEY=VALUE	Encrypt and store a secret in the remote vault
criptenv get KEY	Decrypt and retrieve a secret in memory
criptenv list	List remote secret keys (names only)
criptenv delete KEY	Remove a secret from the remote vault
criptenv push FILE -p PROJECT	Import .env secrets into the remote vault
criptenv pull -p PROJECT -o FILE	Export remote secrets to a file
criptenv import FILE	Import secrets from .env file into the remote vault
criptenv export -o FILE	Export remote secrets to .env or JSON
criptenv rotate KEY	Rotate a secret value
criptenv doctor	Check CLI health and connectivity

---

🌐 Web Dashboard

Prefer a visual interface? Use the web dashboard at:

👉 https://criptenv.77mdevseven.tech

Features:

• Projects & Environments — Organize secrets by project and environment
• Team Management — Invite members, manage roles
• Audit Logs — Complete history of who accessed what and when
• Secret Rotation — Set expiration dates and receive alerts
• Cloud Integrations — Sync secrets with Vercel and Render
• 2FA / OAuth — GitHub, Google, Discord login + TOTP support

---

✨ Features

Feature	Description
🔒 Zero-Knowledge	Server never sees plaintext. AES-256-GCM client-side encryption.
⚡ CLI-First	Natural terminal workflow. Fast, scriptable, automation-friendly.
🌐 Web Dashboard	Visual interface for teams and non-technical members.
🔄 Team Sync	Securely share encrypted vaults across devices and teammates.
📋 Audit Logs	Complete trail of every secret operation.
🔑 CI/CD Native	GitHub Action, CI tokens, and cloud provider sync.
🛡️ 2FA & OAuth	TOTP + GitHub/Google/Discord authentication.
🏗️ Self-Hostable	Open source. Deploy on your own infrastructure.

---

🔒 Security

CriptEnv is built with security as the primary design constraint:

• AES-256-GCM — Industry-standard authenticated encryption
• PBKDF2-HMAC-SHA256 — 100,000 iterations for project vault key derivation
• HKDF-SHA256 — Per-environment key derivation
• HTTP-Only Cookies — Session tokens protected from XSS attacks
• Rate Limiting — Tiered protection against abuse
• Audit Logs — Complete traceability of all operations

We cannot decrypt your secrets. Even with full database access, your data remains cryptographically secure because the encryption key never leaves your devices.

---

📚 Documentation

The repository documentation was audited against the source and deployment manifests on 2026-09-18. The current status and known gaps are tracked in docs/project/current-state.md.

• User Guide: https://criptenv.77mdevseven.tech/docs
• API Reference: https://criptenv-api.77mdevseven.tech/docs
• Local Development: docs/development/local-setup.md
• Architecture & Decisions: docs/project/architecture.md
• Changelog: docs/development/CHANGELOG.md

---

🏗️ For Developers

Want to contribute or self-host? Check out:

• Local Development Guide — Clone, build, and run the full stack locally
• CONTRIBUTING.md — Contribution guidelines, commit conventions, and PR process
• AGENTS.md — Guidelines for AI coding agents

Tech Stack

Layer	Technology
CLI	Python, Click, cryptography
Backend	FastAPI, SQLAlchemy, PostgreSQL 15, Redis
Frontend	Vinext, React 19, Tailwind CSS v4
Deploy	Cloudflare Pages + Workers, VPS Docker, Cloudflare Tunnel
Avatar storage	Cloudflare R2 (recommended) or Supabase Storage

---

📄 License

MIT License — see LICENSE for details.

---