# dotsecenv

> Secure secrets management CLI that encrypts environment variables at rest using GPG, making them safe to commit to version control.

dotsecenv encrypts environment variables at rest using GPG and AES-256-GCM, storing them in vault files that are safe to commit to git. Documentation follows the Diataxis framework: Tutorials walk through tasks, Concepts explain the security model and architecture, Guides cover integrations (shell plugins, GitHub Actions, Terraform, git credentials, Claude Code), and Reference documents the CLI surface.

## Documentation Sets

- [Abridged documentation](https://dotsecenv.com/llms-small.txt): a compact version of the documentation for dotsecenv, with non-essential content removed
- [Complete documentation](https://dotsecenv.com/llms-full.txt): the full documentation for dotsecenv
- [Tutorials](https://dotsecenv.com/_llms-txt/tutorials.txt): Task-oriented walkthroughs: install, first secret, sharing, revocation, CI/CD, migration from .env.
- [Concepts](https://dotsecenv.com/_llms-txt/concepts.txt): Explanations of the security model, threat model, architecture, vault format, and compliance posture.
- [Guides](https://dotsecenv.com/_llms-txt/guides.txt): Integration guides: shell plugins, GitHub Action, Terraform credentials helper, git credentials helper, Claude Code, plus the how-to lookup page.
- [Runbooks](https://dotsecenv.com/_llms-txt/runbooks.txt): Operational runbooks: rotating a compromised GPG key and offboarding a departing team member, with the append-only-vault caveats that apply to both.
- [Reference](https://dotsecenv.com/_llms-txt/reference.txt): CLI reference and changelog.

## Notes

- The complete documentation includes all content from the official documentation
- The content is automatically generated from the same source as the official documentation