# SnapEnv

> SnapEnv is a secure environment variable manager for dev teams and production servers. It stores secrets encrypted, delivers them anywhere via CLI or native integrations, and keeps a full audit trail of every access.

## What it does

SnapEnv replaces the unsafe workflow of committing `.env` files to git, sharing secrets over Slack, or copy-pasting them between servers. It gives teams one encrypted source of truth per environment, with scoped access control and a complete audit log.

It is a self-hosted-friendly alternative to Doppler, 1Password Secrets, HashiCorp Vault, and Infisical — focused on simplicity and fast CLI-first workflows.

## Key features

- AES-256-GCM encryption at rest. Each project has a unique derived key via HKDF-SHA256. No plaintext is ever stored in the database.
- CLI (`snapenv`) for pulling and pushing variables from any terminal, script, or CI pipeline. Single static binary, no runtime required.
- Kubernetes Operator that syncs secrets into native Kubernetes Secret objects and auto-rotates them.
- GitHub Actions integration for injecting variables into CI runs.
- Docker / Docker Compose support via init container pattern.
- Per-environment permissions: developers can write to staging but only read production.
- Variable expiry: set TTLs on secrets, get notified before they expire.
- Webhooks on variable changes.
- Append-only audit log of every pull, push, change, and team action.
- Team access control with workspace roles (Owner, Member) and project roles (Admin, Developer, Read-only).

## Plans

- **Free**: 3 projects, 3 team members, 3 environments per project
- **Pro** ($19/month): 10 projects, 5 team members, 5 environments per project, priority support
- **Team**: Unlimited projects, members, and environments

## CLI usage

Install:
```
curl -fsSL https://snapenv.io/install.sh | sh
```

Authenticate:
```
snapenv login --token snp_live_xxxxxxxxxxxx
```

Pull secrets to a .env file:
```
snapenv pull --env prod
snapenv pull --env staging --output .env.staging
```

Push a local .env file to SnapEnv:
```
snapenv push --env dev --file .env
```

Compare local file to remote:
```
snapenv diff --env prod
```

## Environments

Each project has named environments (default: `dev`, `staging`, `prod`). Variables are isolated per environment. Access tokens can be restricted to specific environments and projects.

## Access tokens

Tokens (`snp_live_` prefix) are created in the dashboard. They support:
- Read or read+write scope
- Restriction to specific environments
- Restriction to a single project or workspace-wide access

Tokens are stored as bcrypt(sha256(plaintext)) — the plaintext is shown once at creation and never again.

## Security model

- Encryption key per project derived via HKDF-SHA256 from a server-side MASTER_KEY
- MASTER_KEY never stored in the database or sent to the CLI
- Decryption is server-side only
- Audit log rows are append-only and never modified or deleted
- Two-factor authentication (2FA) supported

## Links

- Website: https://snapenv.io
- Dashboard: https://dash.snapenv.io
- Documentation: https://docs.snapenv.io
- Quick start: https://docs.snapenv.io/guide/quick-start
- CLI reference: https://docs.snapenv.io/guide/cli
- API reference: https://docs.snapenv.io/api/overview
- Kubernetes Operator: https://docs.snapenv.io/integrations/kubernetes
- GitHub Actions: https://docs.snapenv.io/integrations/github-actions
- GitHub: https://github.com/snapenv-io