Deadenv

Sat, 16 May 2026 00:09:59 +0530

Every developer I know has a .env file they shouldn’t. Maybe it has a production API key. Maybe it’s tracked in git with a .gitignore entry that someone forgot to add. Maybe it’s just sitting there, world-readable, on a shared dev machine. We all know it’s bad. We keep doing it anyway because there’s no real alternative that doesn’t add significant friction.

deadenv is my attempt to fix that. It’s a cross-platform CLI tool written in Go that stores secrets in the OS-native keychain: Keychain on macOS, libsecret/GNOME Keyring on Linux, Credential Manager on Windows, and injects them into subprocesses at runtime. Secrets never touch the filesystem in plaintext.

Cli on funinkina's corner

Deadenv