dotenv.net is a lightweight .NET library for loading environment variables from .env files. It provides both a static API (DotEnv.Load, DotEnv.Read) and a fluent builder (DotEnv.Fluent) for configuring options such as file paths, encoding, trimming, overwrite behavior, directory probing, export syntax support, inline comment stripping, and variable expansion/interpolation. The library supports hierarchical environment cascade loading (e.g., .env, .env.local, .env.{Environment}) and integrates with Microsoft.Extensions.Configuration via a separate package (dotenv.net.Configuration). Internally, it consists of a parser that handles single/double quoted values, multi-line values, and escape sequences; a variable expander that resolves ${VAR}, $VAR, and default fallback syntax with circular dependency detection; and a reader that reads from files or streams, probes parent directories, and merges key-value pairs. The codebase is well-structured with comprehensive unit tests covering edge cases, and targets netstandard2.0/2.1 for broad compatibility.
enject is a security-focused CLI tool that prevents AI agents and other processes from reading secrets out of `.env` files. It stores secrets in an encrypted local store (AES-256-GCM with Argon2id key derivation) and injects them into subprocess environments at runtime. The `.env` file on disk contains only `en://` symbolic references, never plaintext values. The tool provides commands to initialize a store, add/update/list/delete secrets, import a plaintext `.env` file (encrypting all values and rewriting it as a template), rotate the master password, and run a subprocess with resolved environment variables. The architecture is a single Rust binary with a clean `Store` trait abstraction separating the encryption backend from command logic. The codebase demonstrates strong security practices: secrets never touch disk as plaintext, nonces are freshly generated on every write, key material is zeroized immediately after use, and unresolved references cause hard errors. It includes comprehensive unit tests and a CI pipeline with linting, formatting, and security auditing.