Security best practices

Access control

1. Use the least-privilege role that still lets people work.
2. Restrict production reveal and export to owners/admins when possible.
3. Remove members promptly; revoke their API keys the same day.
4. Prefer org API keys for automation — not personal passwords.

API keys

1. One key per machine or pipeline.
2. Descriptive names (ci-prod, laptop-alex).
3. Rotate on a schedule and after any suspected leak.
4. Never commit keys; never put them in frontend env vars shipped to browsers.

Local files

1. Keep .env* in .gitignore.
2. Treat eanvi pull output as sensitive — same as the remote values.
3. Do not paste production env files into tickets, chat, or screenshots.
4. Commit .eanvi/config.json (project defaults) but never ~/.eanvi/credentials.json.

Encryption awareness

1. Values are encrypted at rest; key names are not — avoid putting secrets in key names.
2. Use explicit reveal/pull/export; treat any decrypted output as highly sensitive.
3. Prefer the official CLI or SDK — do not invent custom ways to fetch or decrypt secrets.

Operational habits

1. Change a leaked value in Eanvi, then rotate the third-party credential itself.
2. Use version history to recover from mistaken overwrites.
3. Review Audit Activity for unexpected reveals.
4. Separate development / staging / production environments — never share production values to local by default.

Application design

1. Load secrets at startup from env; do not hardcode fallbacks that bypass Eanvi.
2. Avoid logging environment objects wholesale.
3. In multi-tenant apps, never mix org contexts on a single API key.

Related

• Encryption
• Team collaboration
• FAQ