protect

Install a required Git clean filter for all existing and future repositories for your user. Run this once, even outside a Git repository:

Usage

Run once to protect existing and future repositories on this machine:

$ dotenvx protect
⛉ protection: full (.env*, .env.keys*)

That's it! Attempts to add unencrypted .env secrets to a commit by you (or your coding agent) will be blocked. It even works if your coding agent attempts git add -f.

Watch dotenvx protect in action

Under the hood, this uses a Git filter to check env files before they're staged, letting encrypted files through unchanged. It's installed globally for your Git user, so it works across existing and future repositories on this machine.

FAQ

  • Does it protect existing and future repositories? Yes
  • Does it work in monorepos and subdirectories? Yes
  • Does the plaintext check block git add -f too? Yes
  • Can I still commit encrypted env files? Yes
  • Can I check Docker builds with dotenvx protect --docker? Yes

Options

Related