Enver

Enver handles team secrets, environment variables specifically, with a security architecture you can verify rather than trust. Variables are encrypted client-side with AES-256-GCM, then the master key is split into five Shamir Secret Sharing shares so that no single server ever holds enough to decrypt anything. Their phrase for the backend is a blind courier: it moves ciphertext and share fragments but never sees a key or a plaintext value. The workflow is CLI-first, and the homepage walks through the actual push command showing the derived key, the share splitting, and the three-of-five reconstruction policy, which suggests the team expects technically literate buyers who will actually test the claims. Real-time leakage detection rounds out the feature set. For small teams currently sharing production secrets over chat or a shared drive, this is a meaningful step up without the enterprise pricing of HashiCorp Vault. Worth verifying the threat model fits you: zero-knowledge means lost lock keys are unrecoverable by design.