Your Terminal Remembers Every Secret You've Ever Typed

The author built envsec, a free open-source CLI tool that stores development secrets in OS-native credential stores (macOS Keychain, GNOME Keyring, Windows Credential Manager) instead of leaving them exposed in shell history, ps output, or plaintext .env files. The post highlights real-world risks such as the Shai-Hulud worm incident in September 2025, which compromised 500+ npm packages to harvest .env files, and argues that enterprise secret management tools like HashiCorp Vault or Doppler are overkill for solo developers. envsec leverages existing OS-level encrypted keystores to let developers run commands with secrets injected at runtime, without any cloud dependency or subscription.