sigyn
Your .env files belong in the trash.
Your secrets belong in a vault.
Your .env files belong in the trash.
Your secrets belong in a vault.
Scattered .env files, plaintext tokens in Slack DMs, that one password in a sticky note. sigyn puts all of it in an encrypted local store and injects it straight into your processes.
The kind of encryption that makes cryptographers nod approvingly. Nonce-misuse-resistant, authenticated, and the master key never leaves macOS Keychain.
One fingerprint. That's the whole auth flow. Falls back to your device password, but never asks you to invent yet another password.
Env vars go straight from the encrypted store into your child process. Nothing touches disk. Nothing leaks into git. Your .gitignore can finally relax.
For the terminal dwellers. List projects, peek at your effective env, and launch processes with secrets injected, all without leaving the shell.
local, dev, staging, prod, all living side by side. Mix and match base presets with per-entry overrides when reality gets messy.
Tauri 2 + Rust under the hood. Your data never leaves your machine. No accounts, no cloud, no "we value your privacy" banners.
Always-visible system tray shows your active project and environment at a glance. Switch projects, change environments, lock, or reset overrides without opening the window.
Why roll your own auth when macOS already has Keychain and Touch ID? sigyn leans on the OS for the trust-sensitive bits so it doesn't have to.
Walk away from your laptop? The master key evicts itself from memory after 5 idle minutes and zeroizes every byte on the way out. No crumbs left behind.
| Data | Encrypted |
|---|---|
| Entry values (secrets) | Yes |
| Project names | No |
| Entry names (keys) | No |
| Environment labels | No |
| Categories / descriptions | No |
The whole story: encryption, auth, file permissions, IPC, CSP, CLI safety, and all the things sigyn deliberately doesn't try to do.
Read SECURITY.md →The bundled CLI does its own Touch ID check, reads the same encrypted store as the desktop app, and pipes env vars into your process. Omit --project to use the project selected in the desktop app. No shell eval, no intermediate files, no drama.
$ sigyn list
$ sigyn preview
$ sigyn uv run python -m retail_service
$ sigyn run --project "big-service" -- uv run python -m retail_service
$ sigyn reset-test-data --confirm "delete all data"
PATH, LD_*, DYLD_*, NODE_OPTIONS, and other process-loading vars that could ruin your day.
One script handles the whole thing: builds the Tauri app, drops it in /Applications, and symlinks the CLI onto your PATH. Go grab coffee while Rust compiles.
The usual suspects:
Three lines and a cup of patience:
git clone https://github.com/connorguy/sigyn.git
cd sigyn
./install.sh
Fire it up from /Applications or Spotlight. Touch ID gets you in.
sigyn --help
Create a project, throw in some secrets, select it in the app, then run:
sigyn npm start