Smart .env safety, drift detection, and peer-to-peer end-to-end encrypted key sharing — right inside VS Code.
Features
- Drift detection — flags keys that exist in
.env.examplebut are missing from your.env(and vice-versa) in the Problems panel. - Secret scanner — warns when API keys, tokens, or private keys are hard-coded in source files instead of
.env. - Usage tracer —
Cmd/Ctrl+Clickaprocess.env.KEYto jump to its.envdefinition; hover a.envkey to see every file that uses it. - Encrypted key sharing — share selected
.envvalues with a teammate using their GitHub SSH identity. Keys are encrypted client-side with X25519 + XChaCha20-Poly1305; the relay server only ever sees ciphertext. .env.examplesync — one command to add missing (redacted) keys to your example file.
Commands
| Command | Description |
|---|---|
EnvGuard: Share Keys Securely |
Open the share panel to send encrypted keys |
EnvGuard: Receive Shared Keys |
Import keys from a share link |
EnvGuard: Compare Env Files |
Compare two or more env files |
EnvGuard: Sync .env.example |
Add missing keys to .env.example |
Configuration
| Setting | Default | Description |
|---|---|---|
envguard.relayUrl |
https://relay.envguard.dev |
Relay server URL for encrypted sharing |
envguard.enableSecretScanner |
true |
Warn on secrets in non-.env files |
envguard.secretTTLMinutes |
10 |
Minutes before a shared link expires |
Security model
- The relay stores only ciphertext and never sees plaintext values.
- Share links are one-time (deleted on first read) and expire after 10 minutes.
- A fresh ephemeral key pair is used per message, providing forward secrecy.
- Recipient identity is bootstrapped from their public GitHub
ed25519SSH key.
MVP note: the recipient's X25519 private key is entered manually via a password input.
vscode.SecretStorageintegration lands in v0.2 before any public release.