A secure dotenv–from the creator of `dotenv`. @motdotla
LA & SF
Joined March 2022
- Tweets3K
- Following1
- Followers1.1K
- Likes1.1K
20 mil everyone. thanks for your support.
despite the download count we're prob the quietest biggest secrets solution still. no big hundred mil valuation, just an elegant cryptographic secret-splitting solution that makes you sovereign over your secrets.
thank you kings. 👑
One person can accomplish what once required many. And more code is being written than ever because of it.
Dotenv is somewhat of a yardstick for this. In December ’25 it was doing 300 million installs a month. Today, 750 million. That’s insane growth for a mature fully-distributed project.
Maybe you feel like me - excited but also unsettled, like the whole engineering discipline is completely changing. Where do you set your feet? What do you hold fast to? Every week a new model, new tool, new way to build.. it’s kind of a lot right now.
There’s never been more opportunity, there’s never been more uncertainty.
dotenvx.com/blog/2026/10/26/…
Yes, the only way to protect your organization is to use a secrets-splitting approach like SOPS or Dotenvx.
It is tough these days to build secure software - especially if you are under a major attack like OpenCode. So I feel for them and they build great product.
But this is another example of why you should use a model like Dotenvx or SOPS. Split your secrets cryptographically so that an attacker has to attack both the providers secret store (in this case that is what was attacked) AND the encrypted secret in your code (which was not attacked or even reachable here).
This is why we wrote our whitepaper. Meanwhile, every other provider retweeting OpenCode and saying 'use our secrets store' is repeating the same systematic problem - centralizing your secrets to their secrets store yet again.
Dotenvx or solutions like SOPS are the only way to solve this for your organization.
nitter.cf/opencode/status/211151…
Indeed. Competing projects seem to get all the attention here on twitter, but the cool-handed devs, they choose @dotenvx.
Thank you to all the other cool-hand devs like Chris here using dotenvx!
Man @dotenvx is such an underrated piece of technology. We use it for all our clients and our SaaS. Now you can run dotenvx protect once, and it protects you from agents accidentally committing unencrypted env vars 🔥
Use @1Password with Dotenvx in a click.
New in Dotenvx: One-click custody! 🔑
> With .env.keys now an option and not a default
> we've made it one-click easy for you to
> custody your private key
>
> to @1Password, @Bitwarden, or keychain.
All the benefits of encrypted .env files + the custodian you trust. 🔐❤️
We'll be at @browserbase Navigate on Thurs Sept 10th - rubbing elbows with the best.
Shoot us a DM to talk secrets and agents while there!