Product
A sealed vault for your application configuration.
Vaultlier is a Node.js library, CLI, and platform that replaces the .env workflow. Secrets are encrypted at rest, resolved in memory at runtime, and never written to disk — so you get the convenience of environment variables without scattering plaintext across machines and CI logs.
Secrets never touch disk
The runtime SDK resolves values in memory over HTTPS. The files the CLI generates hold metadata only — key names, types, and scopes, never values.
A four-command CLI
init, pull, push, diff. Add set for one-off writes and dev for a local read-only inspector. The .env workflow you know, without the plaintext file.
Environments, first-class
Model dev, staging, prod, and any custom environment. Scope each key to where it belongs so prod values never leak into a dev shell.
Typed runtime client
Generate a typed accessor for your keys so missing or misspelled config is a compile error, not a 2 a.m. incident.
Scan your codebase
vaultlier scan detects the env vars your code actually uses — process.env, import.meta.env, NestJS config, and more — and reconciles your schema.
Versioned & audited
Every write is a new immutable version. Mutations are recorded in an audit log so you can see who changed what, and when.
Built for teams
Role-based access with least privilege by default: viewers read, members write, and account tokens manage projects without reading secrets.
Bring your own storage
Keep ciphertext in infrastructure you own. Vaultlier encrypts, then stores opaque bytes in your S3 or Postgres — with a built-in fallback.
How it works
Install & init
Add the package and run vaultlier init to link a project and write a metadata-only config.
Define your schema
Declare keys and environments, or let vaultlier scan detect them from your code and .env files.
Resolve at runtime
The typed SDK fetches and decrypts values in memory at startup — nothing is written to disk.