Secure secrets for teamsand every environment.

Secure secrets at runtime, across every environment.

The RunEnv operating model

Context becomes controlled runtime delivery.

RunEnv gives platform teams one deliberate path from repository context to an environment-aware process, without separating developer speed from the controls around it.

Repository context

Start from the work already in front of you.

Quickstart uses the local command as the beginning of a project and environment path.

npm run dev

Repositorymy-api

Environmentdevelopment

Change reviewselected diff

Policy gateapproval if required

Runtime deliverychild process

Recorded outcomesnapshot + audit

01 / Bootstrap once

A CLI that understands the repository before it runs it.

Quickstart detects a local command, links the project and environment, and hands back the next command without turning the demo into a real shell session.

Read the CLI guide

Interactive CLI demo

$runenv quickstart

Quickstart is selected. Press Run demo to see it in action, or choose another flow above.

Simulated in your browser. No command is executed.

Compare the shape of two environments before you move anything.

An interactive reproduction of the RunEnv dashboard’s environment diff workflow using masked, fictional values only.

Environment Compare & Sync

Compare secret differences between two environments and copy values.

Source Environment

Target Environment

Show only items with differences

Showing 13 of 13

Secret Key	test	production
API_KEYChanges	`••••••••`	`••••••••`
AWS_REGIONChanges	`••••••••`	`••••••••`
DATABASE_URLChanges	`••••••••`	`••••••••`
JWT_SECRETChanges	`••••••••`	`••••••••`
NODE_ENVChanges	`••••••••`	`••••••••`
PORTChanges	`••••••••`	`••••••••`
QA_TEST_SECRETNew	`••••••••`	(none)
REDIS_URLChanges	`••••••••`	`••••••••`
S3_BUCKETChanges	`••••••••`	`••••••••`
SMTP_HOSTChanges	`••••••••`	`••••••••`
SMTP_PASSWORDChanges	`••••••••`	`••••••••`
SMTP_PORTChanges	`••••••••`	`••••••••`
SMTP_USERChanges	`••••••••`	`••••••••`

Source

Target (Overwrite)

03 / Promote with intent

Make production changes a reviewable handoff.

RunEnv supports environment promotion with snapshots and approval rules so a developer’s change can move quickly without losing the control point.

Environment promotion

Move selected changes through a controlled environment path.

SourceTarget

+ 2 new↻ 3 changed= 8 unchanged

Selected changes	Policy
`PAYMENTS_API_URL`Changed	approved scope
`FEATURE_BILLING_V2`New	approved scope
`SENTRY_TRACES_SAMPLE_RATE`Changed	approved scope

Policy check: a snapshot is captured before the simulated promotion request.

Snapshot captured before applyProduction approval required

04 / Bound every agent

Issue a narrow access pack instead of a reusable credential.

Agent Access Packs are scope- and TTL-bound. Agent Guard adds policy, approval, and tamper-evident receipts around the action itself.

Explore agent integrations

Create Access Pack

Project

Runtime delivery pack

Limits one agent to selected keys, one environment, and a short-lived session.

Default TTLMax TTL

Require human approval for every request

EnvironmentRead Secret Lifecycle metadataValue-free lifecycle findings and runs only. It never grants secret values or direct mutation.

Exact Secret Keys2 selected

STRIPE_WEBHOOK_SECRETRuntime delivery for webhook validationPAYMENTS_API_URLService endpoint used by the workerSENTRY_DSNObservability runtime configurationFEATURE_BILLING_V2Feature rollout flag

Policy summary. Allow 2 exact keys for payments-api/development; expires after 60 minutes and requires approval.

05 / Keep recovery close

Every change has a version you can inspect and restore.

Environment snapshots and audit history let teams understand the delta first, then take a deliberate rollback action when it is needed.

Snapshot History

development

1 removed1 changed

- SENTRY_DSN=••••••••

~ PAYMENTS_API_URL: •••••••• → ••••••••

Restoring creates a new version and preserves this snapshot in the audit history.

The operational surface

One workspace for environments, controls, and the people who own them.

Secret inventory, environment context, audit controls, members, and access settings meet in the operational surface teams use every day.

RunEnv dashboard showing a project’s environments and masked secret inventory

Authentic product interface. Secret values in the screenshot are masked.

Start with the repository you have.

Create an account, connect a project, and use Quickstart to choose the next safe command for your local workflow.

Create a free account Read the docs