xEnv: Secure Environment Secrets

The Problem

GitHub's secret scanning detected over 10 million leaked secrets in repositories in 2024 alone. Developers store secrets in plaintext .env files, share them via Slack, and commit them accidentally. The problem is structural — secrets exist as complete values in single locations.

Traditional secret managers (Vault, AWS Secrets Manager) centralize secrets behind access control. But the secrets themselves are stored intact — if the vault is breached, every secret is exposed in one place.

Reactive scanning tools like GitHub Advanced Security find leaks after they happen. The secret was already complete, in a single location, waiting to be stolen.

The pattern is always the same: one file, one vault, one environment variable contains the complete secret. Any single compromise = full exposure.

The Old Way

The PRIVATE.ME Solution

xEnv splits every secret into K-of-N threshold shares using XorIDA over GF(2). Shares are stored in separate locations — git, vault, local device. No single location holds a complete secret. Theft of one location yields cryptographic noise.

Each secret is split at write time. The developer runs xenv split .env and shares are distributed to configured backends. The original .env is replaced with share references.

At runtime, xenv reconstruct gathers K shares from available backends and reconstructs the secrets in memory. Secrets never touch disk in plaintext during normal operation.

The security is information-theoretic: K-1 shares reveal zero information about the original secret, regardless of the attacker's computational power.

The New Way

How It Works

xEnv integrates into your existing development workflow with a CLI tool and SDK. Secrets are split once, stored across backends, and reconstructed on demand.

Use Cases

Integration

import { splitEnv, reconstructEnv } from '@private.me/envsplit';

// Split .env file into 2-of-3 shares
const shares = await splitEnv('.env', {
  k: 2, n: 3,
  backends: ['github-secrets', 'vault', 'local']
});
// shares distributed to configured backends

// Reconstruct at runtime
const env = await reconstructEnv({
  backends: ['github-secrets', 'vault'],
  threshold: 2
});
console.log(env.DATABASE_URL); // Available in memory only

Security Properties

Verifiable Data Protection

Every operation in this ACI produces a verifiable audit trail via xProve. HMAC-chained integrity proofs let auditors confirm that data was split, stored, and reconstructed correctly — without accessing the data itself.

Ready to deploy xEnv?

Talk to Ren, our AI sales engineer, or book a live demo with our team.

Ship Proofs, Not Source

xEnv generates cryptographic proofs of correct execution without exposing proprietary algorithms. Verify integrity using zero-knowledge proofs — no source code required.

Use Cases