$ show GreatScott/enject
enject is a security-focused CLI tool that prevents AI agents and other processes from reading secrets out of `.env` files. It stores secrets in an encrypted local store (AES-256-GCM with Argon2id key derivation) and injects them into subprocess environments at runtime. The `.env` file on disk contains only `en://` symbolic references, never plaintext values. The tool provides commands to initialize a store, add/update/list/delete secrets, import a plaintext `.env` file (encrypting all values and rewriting it as a template), rotate the master password, and run a subprocess with resolved environment variables. The architecture is a single Rust binary with a clean `Store` trait abstraction separating the encryption backend from command logic. The codebase demonstrates strong security practices: secrets never touch disk as plaintext, nonces are freshly generated on every write, key material is zeroized immediately after use, and unresolved references cause hard errors. It includes comprehensive unit tests and a CI pipeline with linting, formatting, and security auditing.
The LLM identified 2 files worth highlighting for reuse:
Implements AES-256-GCM encryption with Argon2id key derivation for the secret store. Demonstrates non-obvious security engineering: fresh random nonce on every write to prevent AES-GCM nonce reuse, atomic file writes (temp file + fsync + rename) to prevent corruption, immediate zeroization of key material via the `zeroize` crate, and proper error handling for wrong passwords and tampered ciphertext (AES-GCM authentication). The `PasswordStore` struct encapsulates all encryption logic behind the `Store` trait, making it a self-contained, extractable component for any project needing encrypted local secret storage.
Provides a robust parser for `.env` template files containing `en://` references (and legacy `ev://` references). Handles comments, blank lines, plain key-value pairs, local references, and global references. Includes a `resolve` function that maps references to secret values with hard errors on missing keys, and a `templatize` function for rewriting plain values as references (used by `import`). Also implements an interactive migration prompt for legacy `ev://` prefixes, with automatic backup creation. The module has no internal dependencies beyond `crate::error`, making it easily reusable in other Rust projects that need to parse and resolve templated environment files.