PushEnv is a local-first, encrypted workflow for managing environment variables. Secrets are encrypted on the developer’s machine before being stored, and only ciphertext is ever uploaded. There’s no dashboard, no accounts, and no SaaS dependency — just a Git-style push/pull/diff/history flow for .env files.

It also supports type-safe env validation with Zod, zero-file secret injection for CI, and versioned rollbacks.

This is an early version, and I’d really appreciate feedback from people who’ve dealt with secrets management at scale — especially around security assumptions, workflow design, and real-world edge cases.