Git-Native Environment & Secrets Management | Ghostable Git-native environment management Stop babysitting .env files. ============================== Keep encrypted, reviewable environment configuration with your code. Ghostable gives developers, agents, and CI the right values—without accounts, usage limits, or a hosted secrets server. Homebrew npm $ `brew tap ghostable-dev/ghostable && brew install --cask ghostable` [ How it works ](#how-ghostable-works) [ Explore the docs ](https://ghostable.dev/docs) No account required · Unlimited environments · Free forever How Ghostable works Configuration travels with the code. Plaintext doesn't. --------------------------------------------------------- Ghostable stores encrypted values and signed access records in `.ghostable/`. Git moves them; approved devices decrypt only the environments they can use. Safe in Git ### Encrypted records live with the project. The directory is designed to be committed, reviewed, branched, and merged with the application. ``` .ghostable/ ├── environments/ │ ├── development/ │ ├── staging/ │ │ └── values/ │ │ ├── APP_KEY.json │ │ ├── DATABASE_URL.json │ │ └── STRIPE_SECRET_KEY.json │ └── production/ ├── devices/ └── policy.json ``` Encrypted values Signed records Inspectable records ### The secret is hidden. The record is not. Each key has its own encrypted value record. The environment, key name, version, and encryption method stay visible while the value remains ciphertext. APP\_KEY.json Encrypted value ``` { "environment": "staging", "key": "APP_KEY", "version": 4, "secret": { "ciphertext": "b64:U6JxZHOGVT/…", "alg": "xchacha20-poly1305" } } ``` Device access ### Every device gets exactly the access it needs. A device can read one environment, write another, or approve access without gaining permission to change values. Trusted devices 3 active Your MacBook Pro This device development read + write staging read + approve production read Maya’s MacBook Air development read + write staging read GitHub CI/CD runner production read only Reviewed in Git ### Review configuration like code. A rotation changes one value record. Reviewers see exactly which environment and key moved, without seeing the secret itself. rotate-staging-key 2 files changed M .ghostable/environments/staging/values/APP\_KEY.json A .ghostable/events/variable.updated-staging.json @@ APP_KEY.json - "version": 3, + "version": 4, - "ciphertext": "b64:Xm91p…" + "ciphertext": "b64:U6JxZ…" One key, one diff No plaintext exposed Local-first. Provider-agnostic. Secrets management. Minus the service. ---------------------------------------- Ghostable runs where your code runs and keeps encrypted project state with the repository. There is no account to create, hosted secrets service to trust, subscription to renew, or provider-specific setup to migrate. $0 forever ### No subscription. - ∞Unlimited environments. - ∞Unlimited encrypted variables. - ∞Unlimited team members. No account ### Install and go. Install with Homebrew or npm, initialize the repository, and start in minutes. No workspace or tenant to provision. No hosted vendor ### One less service to trust. Your plaintext secrets never reach a Ghostable service. There is no additional vendor to audit, approve, or place in your runtime path. Belongs to the repository ### Take it anywhere your code goes. Ghostable travels with the repository, not the hosting provider. Change clouds, tools, or runtimes without migrating your secrets workflow. 1. Local machines The same workflow on macOS, Windows, and Linux. 2. Agents and worktrees Encrypted project state follows every development context. 3. CI/CD runners Validate and decrypt inside the authorized job. 4. Any hosting provider AWS, Azure, Vercel, self-hosted, or whatever comes next. Works with your stack ### If it’s configurable, it’s Ghostable. Framework-agnostic and native on macOS, Windows, and Linux. If your project reads environment variables, Ghostable fits. - ![Laravel logo](https://ghostable.dev/images/platforms/laravel.svg) Laravel - ![Node.js logo](https://ghostable.dev/images/platforms/nodedotjs.svg) Node.js - ![Next.js logo](https://ghostable.dev/images/platforms/nextdotjs.svg) Next.js - ![Vercel logo](https://ghostable.dev/images/platforms/vercel.svg) Vercel - ![Docker logo](https://ghostable.dev/images/platforms/docker.svg) Docker - ![GitHub Actions logo](https://ghostable.dev/images/platforms/githubactions.svg) GitHub Actions - ![React logo](https://ghostable.dev/images/platforms/react.svg) React - ![Vue.js logo](https://ghostable.dev/images/platforms/vuedotjs.svg) Vue.js - ![Python logo](https://ghostable.dev/images/platforms/python.svg) Python - ![Ruby logo](https://ghostable.dev/images/platforms/ruby.svg) Ruby - ![Go logo](https://ghostable.dev/images/platforms/go.svg) Go - ![Laravel logo](https://ghostable.dev/images/platforms/laravel.svg) Laravel - ![Node.js logo](https://ghostable.dev/images/platforms/nodedotjs.svg) Node.js - ![Next.js logo](https://ghostable.dev/images/platforms/nextdotjs.svg) Next.js - ![Vercel logo](https://ghostable.dev/images/platforms/vercel.svg) Vercel - ![Docker logo](https://ghostable.dev/images/platforms/docker.svg) Docker - ![GitHub Actions logo](https://ghostable.dev/images/platforms/githubactions.svg) GitHub Actions - ![React logo](https://ghostable.dev/images/platforms/react.svg) React - ![Vue.js logo](https://ghostable.dev/images/platforms/vuedotjs.svg) Vue.js - ![Python logo](https://ghostable.dev/images/platforms/python.svg) Python - ![Ruby logo](https://ghostable.dev/images/platforms/ruby.svg) Ruby - ![Go logo](https://ghostable.dev/images/platforms/go.svg) Go [ See how local-first storage works ](https://ghostable.dev/learn/zero-knowledge-encryption) The Ghostable CLI One install. A remarkably deep toolkit. ----------------------------------------- Ghostable brings the entire environment workflow into one free, repository-native command line. No collection of paid add-ons required. ### Git-native storage Keep encrypted values and signed project state beside the code they configure. ### One key, one file Review, merge, and trace individual variable changes without rewriting a shared blob. ### Unlimited environments Create as many isolated development, staging, preview, and production environments as you need. ### Local encryption Encrypt and decrypt on authorized machines without sending plaintext through a hosted secrets service. ### Device identities Give every workstation its own signing and encryption identity scoped to the project. ### Granular access roles Grant reader, writer, or grantor access independently for each environment. ### Access requests Request, approve, deny, and review new device access through signed repository records. ### Revocation and rotation Revoke a device and rotate affected environment keys without rebuilding the project. ### Process-only injection Run commands with decrypted values injected directly into the authorized child process. ### Output masking Best-effort masking keeps exact injected values out of child stdout and stderr. ### Validation schemas Commit required, URL, numeric, regex, range, and other rules as plaintext contracts. ### Environment overrides Layer environment-specific rules over the project-wide schema when requirements differ. ### Cross-environment rules Require sensitive values to differ between environments and catch unsafe reuse. ### Variable promotion Move selected configuration between environments with explicit reviewable changes. ### Local file workflows Pull, push, sync, and safely materialize local environment files when tools need them. ### Environment comparison See missing, changed, and matching keys before copying or deploying configuration. ### Pull request review Summarize configuration changes between Git refs without revealing encrypted values. ### Secret scanning Scan repository changes for likely plaintext credentials before they reach the main branch. ### Automation output Emit JSON, GitHub annotations, and SARIF where supported for CI and security tooling. ### Signed activity Record configuration and access operations in a tamper-evident project timeline. ### Encrypted backups Create and restore portable encrypted snapshots without depending on a Ghostable server. ### Deployment adapters Deploy to local files, Forge, Vapor, and Laravel Cloud without replacing unrelated keys. ### Scoped CI credentials Issue purpose-built automation access instead of reusing a person’s device identity. ### Agent-ready guidance Generate repository instructions and adoption prompts for coding assistants and agents. And even more. Annotations, examples, hygiene checks, backups, drift workflows, and a growing command surface are included. [ Explore every command ](https://ghostable.dev/docs/3.x/reference/commands) Ready to take control of your configuration? ---------------------------------------------- Homebrew npm $ `brew tap ghostable-dev/ghostable && brew install --cask ghostable` [ Prefer a visual workflow? Check out Ghostable Desktop ](https://ghostable.dev/desktop) Frequently asked questions ---------------------------- Is it safe to commit Ghostable files to Git? Yes. Ghostable commits encrypted values, signed access records, and reviewable metadata. Keep plaintext .env files and private device identities out of Git. Can anyone with repository access decrypt our secrets? No. Cloning the repository is not enough. Decryption requires an authorized device identity with access to that environment, or a scoped automation credential. How do teammates get access? Each person joins with their own project-scoped device identity. An authorized owner or grantor can approve reader, writer, or grantor access for the environments they need. Can I use Ghostable in CI/CD? Yes. Give CI its own scoped automation credential instead of a human device identity, then grant only the environment and reader or writer role that job needs. Can I revoke a lost device or a former teammate? Yes. Revoking a device removes its grants and rotates the affected environment keys. It cannot erase secrets that device had already seen, so rotate those underlying provider credentials when necessary. Can I bring my existing .env files? Yes. Start from an existing environment file, then move each value into an encrypted record that is safe to review and commit. Can I validate configuration before deploy? Yes. Commit shared validation rules with the project, then run the same checks locally and in CI before a configuration change ships. Do I need the CLI? The CLI is the primary repository-native workflow for developers and CI. It handles encryption, access, validation, review, and running authorized processes from the terminal. Is Ghostable Desktop required? No. Ghostable Desktop is the optional paid app for people who want a focused visual workflow alongside the CLI. Personal licenses start at $49 one-time. Does Ghostable work with my stack? Yes. Ghostable fits environment-driven workflows across Laravel, Node, Python, Ruby, Go, and similar stacks. Ghostable Desktop Take Ghostable to your desktop. --------------------------------- Review environments, validation, and access in a focused visual app. Choose the build for macOS, Windows, or Linux. [ Explore Ghostable Desktop ](https://ghostable.dev/desktop) Personal licenses start at $49 one-time and include one year of Desktop updates. ![Ghostable Desktop app icon](https://ghostable.dev/images/desktop/icon.png) macOS Windows Linux