██████╗ ███████╗██╗ ██╗██╗ ██╗ █████╗ ██╗ ████████╗
██╔══██╗██╔════╝██║ ██║██║ ██║██╔══██╗██║ ╚══██╔══╝
██║ ██║█████╗ ██║ ██║██║ ██║███████║██║ ██║
██║ ██║██╔══╝ ╚██╗ ██╔╝╚██╗ ██╔╝██╔══██║██║ ██║
██████╔╝███████╗ ╚████╔╝ ╚████╔╝ ██║ ██║███████╗██║
╚═════╝ ╚══════╝ ╚═══╝ ╚═══╝ ╚═╝ ╚═╝╚══════╝╚═╝
🔐 Developer Environment & Secrets Lifecycle Manager
DevVault is a Bash-based CLI tool for developers who are tired of API keys sitting unencrypted in .env files. It gives you a local, encrypted vault for secrets, per-project environment profiles, SSH key lifecycle management, and a full audit trail — all from a single interactive terminal menu.
Most developers manage secrets by scattering them across .env files, shell history, and sticky notes. DevVault centralizes that into one encrypted, auditable store on your own machine — no cloud dependency, no third-party service, just openssl and your terminal.
- Add, reveal, list, delete, and rotate secrets — each encrypted individually with AES-256-CBC (via
openssl, PBKDF2 with 100,000 iterations) - Optional expiry dates per secret, with status shown at a glance (active / expiring soon / expired)
- Encrypted export/import so vaults can be backed up or moved between machines
- Secure delete — overwrites the file with random data before removing it
- Clipboard copy on reveal, with automatic clearing after 30 seconds
- Create named profiles (
production,staging,local, etc.) as editable env-var files - Switch profiles to export variables directly into your current shell session
- Export any profile to a standard
.envfile
- Generate new key pairs (ed25519 / RSA / ECDSA) under DevVault's management
- List managed keys, inspect fingerprints, copy public keys to clipboard
- Test an SSH connection and clean up keys you no longer need
- Scans your vault for secrets nearing or past their expiry date so rotation doesn't get forgotten
- Every vault, profile, and SSH operation is logged with a timestamp and user — so you always know what happened and when
- Built-in diagnostics to confirm dependencies, permissions, and vault integrity are all in order
- Bash (Linux/macOS, or WSL on Windows)
- Required:
openssl,base64,date,find,grep,sed,awk - Optional (unlocks extra features):
gpg,jq,curl,ssh-keygen,git
git clone https://github.com/Shahzaib/DevVault.git
cd DevVault
chmod +x devvault.sh
./devvault.shFor convenience, symlink it onto your PATH:
ln -s "$(pwd)/devvault.sh" /usr/local/bin/devvaultLaunch the interactive menu:
devvaultOr use quick non-interactive commands:
devvault secret add # Add a secret
devvault secret get <name> # Reveal a secret by name
devvault profile use <name> # Switch to an environment profile
devvault expiry # Run the expiry check and exit
devvault health # Run a system health check and exit
devvault --help # Show usageAll data lives locally under ~/.devvault/ (configurable via DEVVAULT_HOME), with strict 600/700 permissions applied to every file and directory.
- Encryption: every secret is encrypted independently with AES-256-CBC using a key derived from your master password via PBKDF2 (100,000 iterations), so no plaintext secret ever touches disk
- Session handling: the master password is held in memory only for a configurable timeout (default 5 minutes) and can be cleared manually with the lock command
- Storage layout:
~/.devvault/ ├── vaults/ # encrypted .vault files, one per secret ├── keys/ # SSH keys generated/managed by DevVault ├── profiles/ # environment variable profiles ├── audit.log # full operation history └── config # user configuration
- The master password is never written to disk — only held in memory for the session
- Every sensitive operation (add, reveal, rotate, delete, export, import) is written to the audit log
- Deleted secrets are overwritten with random bytes before removal, not just unlinked
MIT
Built by @Shahzaib — CS student, CCNA instructor, and cybersecurity practitioner focused on practical developer and security tooling.