.env.vault.local

npx dotenvx set DEBUG "myapp:*" --env local --encrypt
# This updates .env.vault.local

Dotenv Vault is a commercial environment management tool that provides encrypted .env.vault files. These vaults store environment variables securely and allow teams to sync them across development, CI/CD, and production environments without exposing plaintext secrets.

Do not put DOTENV_KEY inside your .env.vault.local file. That defeats the purpose. Instead, set it in your shell profile (.bashrc, .zshrc) or use a secrets manager like 1Password CLI to inject it. .env.vault.local

Because the file is encrypted, you could theoretically commit it to Git without exposing secrets. However, by keeping it .local and in .gitignore, you avoid merging conflicts and preserve machine-specific configuration. npx dotenvx set DEBUG "myapp:*" --env local --encrypt

Your team shares an encrypted .env.vault containing production and staging secrets. Dotenv Vault is a commercial environment management tool

# .env.vault (Committed to Git)
# This is encrypted. You can't read it directly.
DOTENV_VAULT="vault-v1..."

Let's travel back to the traditional .env workflow to see why .env.vault.local became necessary.