v2.4Encrypted overrides per environment — now generally available

Secrets that shush when they need to.

The secrets manager that thinks like a developer. Environments, folders, diffs, and an audit log that actually reads — wired to every framework and CI you already use.

app.shush.io / stagehand / shush-api / secrets
⌘K
stagehand/shush-api//payments
Key
Value
Updated
Envs
STRIPE_SECRET_KEY
3d ago · Maya
DSPPR
STRIPE_WEBHOOK_SECREToverride
3d ago · Maya
DSPPR
DATABASE_URL
2h ago · Maya
DSPPR
OPENAI_API_KEY
6h ago · Priya
DSPPR
JWT_SECREToverride
8d ago · Theo
DSPPR
Live audit · just now
RBrotation-bot rotated STRIPE_WEBHOOK_SECRET
MCMaya updated DATABASE_URL in prod
VSvercel-sync synced 15 keys to prod
shush pull · 200ms
$shush pull --env=prod
20 secrets · decrypted
wrote .env.production
Wired to the stack your team already uses
Vercel
NNext.js
GGitHub
awsAWS
FFly.io
K8Kubernetes
SStripe
SbSupabase
CFCloudflare
NNetlify
RRailway
DDDatadog
SeSentry
PhPostHog
LLinear
Vercel
NNext.js
GGitHub
awsAWS
FFly.io
K8Kubernetes
SStripe
SbSupabase
CFCloudflare
NNetlify
RRailway
DDDatadog
SeSentry
PhPostHog
LLinear
Built for the way you ship

Six tools, one home. Every secret in its place.

No more grep'ing `.env`s in Slack. shush gives every key an environment, an owner, a history, and a way home — without slowing the room down.

Environments that actually mean something

Dev, staging, preview, prod — first-class, with per-env overrides, inheritance, and a diff view that tells you exactly which values drift.

Key
dev
staging
prod
NEXT_PUBLIC_APP_URL
localhost:3000
stg.shush.io
app.shush.io
STRIPE_SECRET_KEY
sk_test_51N4kT…
sk_test_51N4kT…
sk_live_51N4kT…
SENTRY_DSN
— not set
o4505@sentry.io
o4505@sentry.io

Time travel for your config

Every change versioned. Roll back any value in one click. Know who, what, when — and why.

v7Maya Chen3d ago
sk_live_51N4kT2K9MnL8pQrXvBwY3Zc…
v6Theo Martinez12d ago
sk_live_51N4kT2K9MnL8pQrXvBwY3Zc…
v5rotation-bot1mo ago
sk_live_51K3jS1J8LnK7pQrXvBwY3Zc…

CLI that just works

One command pulls the right secrets into the right env. Wire it into package.json, your Dockerfile, or any CI — and never paste a key again.

$shush login
✓ authenticated · Maya Chen · stagehand
$shush run --env=prod -- node server.js
24 secrets loaded into env
spawning node server.js
server listening on :3000

An audit log you can read

Every read, write, rotate, and delete — timestamped, attributed, exportable to SIEM. Catch leaks before they leak.

2m agoMCMaya Chen · in prod DATABASE_URLupdate
12m agoRBrotation-bot · automatically in prod STRIPE_WEBHOOK_SECRETrotate
1h agoPSPriya Shah · in dev ANTHROPIC_API_KEYcreate
3h agoVSvercel-sync · synced to prod (15 secrets)update
yest.TMTheo Martinez · in preview NEXT_PUBLIC_APP_URLupdate
yest.SPSam Park · in prod LOOPS_API_KEYcreate
2d agoMCMaya Chen · all envs MAILGUN_API_KEYdelete
3d agoMCMaya Chen · manually in prod STRIPE_SECRET_KEYrotate
2m agoMCMaya Chen · in prod DATABASE_URLupdate
12m agoRBrotation-bot · automatically in prod STRIPE_WEBHOOK_SECRETrotate
1h agoPSPriya Shah · in dev ANTHROPIC_API_KEYcreate
3h agoVSvercel-sync · synced to prod (15 secrets)update
yest.TMTheo Martinez · in preview NEXT_PUBLIC_APP_URLupdate
yest.SPSam Park · in prod LOOPS_API_KEYcreate
2d agoMCMaya Chen · all envs MAILGUN_API_KEYdelete
3d agoMCMaya Chen · manually in prod STRIPE_SECRET_KEYrotate

Plugged into everything

Push to Vercel, Netlify, Fly, AWS Parameter Store, or your own Kubernetes. Webhooks fire on every change, so your runtime stays in lockstep.

Vercelsynced
AWAWS SSMsynced
FLFly.iosynced
K8Kubernetessynced
GHGitHubsynced
DCDopplerimport

Role-based access, with receipts

Scope keys to people, services, and environments. SSO via SAML, SCIM provisioning, and a permission model your security team will actually approve.

MCMaya Chen
maya@stagehand.io
owner
TMTheo Martinez
theo@stagehand.io
engineer
RBrotation-bot
service token · expires 90d
service
From `.env` to shush, in 3 minutes

Install. Pull. Ship.

Migrating off plaintext takes one afternoon. Most teams are running everything through shush by Monday.

Install the CLI

One binary, every OS. Or pull it from npm, brew, or your preferred package manager.

$brew install shush-io/tap/shush
✓ shush 2.4.0

Import your .env

Point shush at your existing file. It diffs, dedupes, encrypts, and uploads — keys land in folders automatically.

$shush import .env.local --env=dev
✓ 18 secrets imported
3 promoted to /payments

Run anywhere

Wrap any command. Your app sees secrets as env vars, decrypted at runtime — never written to disk.

$shush run --env=prod -- pnpm start
✓ 24 secrets injected
ready on :3000
Security by default

Your keys are useless to us.

End-to-end encryption with keys you own. Even if we wanted to read your secrets — and we don't — we couldn't.

  • AES-256-GCM at rest, TLS 1.3 in flight, with per-project encryption keys rotated quarterly.
  • BYOK — bring your own KMS root key from AWS, GCP, or HashiCorp Vault. We never see plaintext.
  • SOC 2 Type II, ISO 27001, HIPAA ready. Annual penetration tests. Public bug bounty.
  • Zero-knowledge clients on every platform. Your laptop decrypts; our servers never can.
  • Self-host the whole stack if you'd rather. Same Docker image we run in production.
Encryption — stagehand · prod
Master key256b
Data keys90%
Entropy7.99
Quorum status3 / 3
CipherAES-256-GCM
KDFArgon2id
KMSaws/us-east-1
Last rotated7 days ago
Pricing

Start free. Scale when you do.

No per-seat tax. No per-secret nickel-and-diming. Every plan includes audit logs, version history, and the full CLI.

Hobby
$0/forever

For solo devs, side projects, and learning.

  • 3 projects
  • 4 environments per project
  • 7-day audit log
  • Community Discord
Enterprise
Custom

For teams with security teams.

  • SAML SSO + SCIM provisioning
  • BYOK · self-host · air-gapped
  • Unlimited audit retention
  • 99.99% SLA · 24/7 support
  • Dedicated success engineer

Your `.env` doesn't have to be a liability.

Three minutes to install. Zero to your first secret. Bring the whole team.

$brew install shush-io/tap/shush && shush login
✓ welcome, you