dotsafe for your stack

Run tests and dev servers with real keys it never sees.

Let the agent use your keys to run commands, never to read them.

Codex tasks with real API keys, kept out of what it reads.

Replace .env.local, and keep secrets out of NEXT_PUBLIC_.

VITE_ variables and server secrets, without .env files.

Drop dotenv: process.env from an encrypted vault.

Django, Flask and FastAPI secrets into os.environ.

ENV and RAILS_MASTER_KEY, encrypted on your Mac.

Push each rotated secret to your Vercel projects.

Set Worker secrets on every rotation, no wrangler secret put.