--redact
Runtime leak protection and log redaction for secrets. Run commands with real environment variables while redacting their values from stdout, stderr, and logs.
Usage
--redact is runtime leak protection and log redaction for your secrets. Your process still gets the real environment variables, but matching values are stripped from stdout and stderr before they can leak into terminals, CI logs, or agent transcripts. Keys ending in _PLAIN are left visible.
$ echo "SECRET=super-secret-value" > .env
$ echo "VISIBLE_PLAIN=visible-value" >> .env
$ echo "console.log(process.env.SECRET, process.env.VISIBLE_PLAIN)" > index.js
$ dotenvx run --redact --quiet -- node index.js
[REDACTED] visible-valueRedaction is off by default. It applies to every key declared in .env files and --env flags unless the key ends in _PLAIN. If an existing environment variable takes precedence, its effective value is redacted too. Matching is exact, so transformed or derived values are not redacted.
Use it anywhere secrets might print at runtime — local shells, CI pipelines, coding agents, and long-running services whose logs you do not want holding plaintext credentials.
When stdin, stdout, and stderr are attached to a terminal, dotenvx preserves interactive behavior on macOS and Linux systems with script available. Piped and redirected commands continue to use normal stdin, stdout, and stderr streams.