---
name: "dotenv-vault-encrypted-env"
description: "Encrypt production environment variables into .env.vault files for secure repository commits."
metadata:
  author: "Dotenv"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "encrypt .env with dotenv vault"
  - "use dotenv_key"
  - "sync dotenv vault"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Dotenv Vault Encrypted Environment Variables & Secrets

Implements Dotenv Vault: encrypting .env files into .env.vault with AES-256, managing environment keys (DOTENV_KEY), syncing secrets across development and production, and eliminating plain text leaks.

## When to Invoke
Invoke this skill whenever you need to:
- encrypt .env with dotenv vault
- use dotenv_key
- sync dotenv vault

## Execution SOP & Rules
1. Initialize vault: npx dotenv-vault new.
2. Push local secrets: npx dotenv-vault push and build encrypted vault: npx dotenv-vault build.
3. Commit .env.vault safely to version control.
4. In production environment: export DOTENV_KEY='dotenv://:key_123...' to decrypt on startup.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.