envref

envref is a command-line tool designed for developers who want to separate configuration from secrets in their .env files. Instead of storing plaintext secrets, it uses ref:// references that point to secure backends like OS keychains, 1Password, AWS SSM, or HashiCorp Vault. The .env file becomes safe to commit to version control while secrets remain encrypted and isolated.

The tool supports seven backend types, integrates with direnv for automatic resolution when entering a project directory, and includes features like layered .env merging, variable interpolation, schema validation, and profile-based environment switching. It resolves references in under 50ms and can inject resolved variables into subprocesses. The maker built it with Claude Code to demonstrate autonomous CLI development.