articleMarch 2026
Introducing EnvSync
Why we built another secrets manager: most teams don't need zero-knowledge encryption and a six-figure compliance package, they need their .env files out of Slack. Here's the shape of what we shipped.
Blog
Notes on building EnvSync — security decisions, product tradeoffs, and the occasional post-mortem.
articleApril 2026
Envelope encryption, explained without the jargon
A per-org data key wrapped by a master key sounds complicated until you draw it out. Here's why we picked this design over encrypting every secret directly with one shared key.
articleMay 2026
RBAC that actually matches how teams work
Most permission systems either give you three roles and no flexibility, or a rules engine nobody wants to configure. We landed on sane defaults plus an editable matrix — here's why.
articleJune 2026
What 'zero external dependencies' buys you in a CLI
Our CLI ships with no npm dependencies at all — just Node's built-ins. That's a smaller supply-chain surface for a tool that holds decrypted secrets in memory. Worth the extra code.