Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: enveil – hide your .env secrets from prAIng eyes

github.com

Post reply on HN
Print view View original

61–70 of 152 posts

Re: Show HN: enveil – hide your .env secrets from prAIng eyes

#61

Post by zith »

I must have missed some trends changing in the last decade or so. People have production secrets in the open on their development machines?

Or what type of secrets are stored in the local .env files that the LLM should not see?

I try to run environments where developers don't get to see production secrets at all. Of course this doesn't work for small teams or solo developers, but even then the secrets are very separated from development work.

Re: Show HN: enveil – hide your .env secrets from prAIng eyes

#63

Post by tuvistavie »

zith wrote: post #61

I must have missed some trends changing in the last decade or so. People have production secrets in the open on their development machines? Or what type of secrets are stored in the local .env files that the LLM should not see? I try to run environments where developers don't get to see production secrets at all. Of course this doesn't work for small teams or solo developers, but even then the secrets are very separa…

I think having API keys for some third-party services (whatever LLM provider, for example) in a .env file to be able to easily run the app locally is pretty common. Even if they are dev-only API keys, still not great if they leak.

Re: Show HN: enveil – hide your .env secrets from prAIng eyes

#64

Post by Malcolmlisk »

zith wrote: post #61

I must have missed some trends changing in the last decade or so. People have production secrets in the open on their development machines? Or what type of secrets are stored in the local .env files that the LLM should not see? I try to run environments where developers don't get to see production secrets at all. Of course this doesn't work for small teams or solo developers, but even then the secrets are very separa…

Usually, some people change their .env files in the root of the project to inject the credentials into the code. Those .env files have the credentials in plain text. This is "safe" since .gitignore ignores that file, but sometimes it doesn't (user error) and we've seen tons of leaks because of that. Those are the variables and files the llms are accessing and leaking now.

Re: Show HN: enveil – hide your .env secrets from prAIng eyes

#65

Post by portly »

zith wrote: post #61

I must have missed some trends changing in the last decade or so. People have production secrets in the open on their development machines? Or what type of secrets are stored in the local .env files that the LLM should not see? I try to run environments where developers don't get to see production secrets at all. Of course this doesn't work for small teams or solo developers, but even then the secrets are very separa…

Sometimes it can be handy for testing some code locally. Especially in some highly automated CICD setups it can be a pain to just try out if the code works, yes it is ironic.

Re: Show HN: enveil – hide your .env secrets from prAIng eyes

#67

Post by chrismatic »

Zizizizz wrote: post #11

https://github.com/getsops/sops This software has done this for years

We just recently adopted this and it's crazy to me how I spent years just copying around gitignored .env files and sharing 1password links. Highly underrated tool.

Re: Show HN: enveil – hide your .env secrets from prAIng eyes

#69

Post by [deleted] »

wswin wrote: post #54
jumploops wrote: post #38

Earlier quoted context omitted.

In the context of traditional SaaS, using dynamic secrets loaded at runtime (KMS+Dynamo, etc.). For agentic tools and pure agents, a proxy is the safest approach. The agent can even think it has a real API key, but said key is worthless outside of the proxy setting.

These are from AWS right, what about simple, no cloud setups with just docker compose or even bare proccesses on a VPS?

[deleted]
Post reply on HN