The Complete Production SOP: How to Deploy and Run Dotenv Vault Encrypted Environment Variables & Secrets in Autonomous AI Agents

---
name: "dotenv-vault-encrypted-env"
description: "Encrypt production environment variables into .env.vault files for secure repository commits."
metadata:
  author: "Dotenv"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "encrypt .env with dotenv vault"
  - "use dotenv_key"
  - "sync dotenv vault"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Dotenv Vault Encrypted Environment Variables & Secrets

Implements Dotenv Vault: encrypting .env files into .env.vault with AES-256, managing environment keys (DOTENV_KEY), syncing secrets across development and production, and eliminating plain text leaks.

## When to Invoke
Invoke this skill whenever you need to:
- encrypt .env with dotenv vault
- use dotenv_key
- sync dotenv vault

## Execution SOP & Rules
1. Initialize vault: npx dotenv-vault new.
2. Push local secrets: npx dotenv-vault push and build encrypted vault: npx dotenv-vault build.
3. Commit .env.vault safely to version control.
4. In production environment: export DOTENV_KEY='dotenv://:key_123...' to decrypt on startup.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.

// Ensure dotenv is imported at the absolute entrypoint of your application
require('dotenv').config();

if (!process.env.DATABASE_URL) {
  console.error('FATAL: DATABASE_URL is not defined in environment or .env.vault');
  process.exit(1);
}

console.log('Environment decrypted and loaded successfully.');

#!/usr/bin/env bash
set -euo pipefail

# Step 1: Ensure workspace has vault configuration initialized
if [ ! -f ".env.vault" ]; then
  echo "Building .env.vault from local development secrets..."
  npx dotenv-vault build
fi

# Step 2: Validate generated ciphertext structure
grep -q "DOTENV_VAULT_DEVELOPMENT" .env.vault && echo "Vault verified."

#!/usr/bin/env bash
set -euo pipefail

# Smoke test decryption using local test key
if [ -z "${DOTENV_KEY:-}" ]; then
  echo "SKIP: DOTENV_KEY not set in sandbox runner. Checking .env.vault file presence."
  test -f .env.vault
  echo "Vault file exists and is intact."
else
  node -e "require('dotenv').config(); console.log('Decryption verified.');"
fi