Enclave is a modern developer-first secrets management tool designed to eliminate plaintext .env file leakage. Instead of spreading environment configurations in unsecured files across team members, Enclave keeps everything encrypted and securely injects it inside runtime memory when executing processes.

By utilizing a Git-like workflow (init, pull, push), Enclave integrates seamlessly with the developer tools you already use, ensuring that team alignment and conflict-free versioning occur naturally.

To interface with the secure Enclave platform, install the official Enclave CLI using NPM or your preferred package manager.

Verify that the CLI is correctly installed by checking the current version:

The init command links your current working directory to a secure, active Enclave environment. It generates a local, encrypted configuration file containing workspace metadata so the CLI knows where to push and pull secrets.

Flags & Options

• --force : Reinitialize workspace metadata even if config already exists.
• --config [path] : Define a custom location for saving local configuration metadata.

The run command is the core execution hook of Enclave. It downloads remote project configuration keys, performs on-the-fly AES-256-GCM decryption in application memory, and injects them directly into the target environment without writing any environment files to disk.

Example usages

The pull command queries the remote server to fetch updated secret keysets. If a teammate has pushed modifications, running pull updates your secure registry cache.

The push command publishes locally staged edits back to the remote server. To prevent accidental overrides, Enclave performs a fast-forward verification checks before committing. If updates are found on the server, you must run pull first.