(01) · Case study

30 core systems

Enver/ DevSecOps SaaS Platform

Enver is an open-source zero-knowledge environment variable orchestration platform for teams that refuse to trust a third party with production keys. It encrypts secrets client-side with AES-256-GCM and splits the master key via Shamir's Secret Sharing (5-of-3). The server never sees plaintext, never holds a decryption key, and cannot leak what it doesn't have. Ships with a web dashboard, CLI, VSCode extension, and REST API.

Visit live site↗← All projects
  • DateAugust 2026
  • RoleAI & Systems Engineer
  • TypeDevSecOps SaaS Platform
  • Duration2 weeks (MVP launch)
  • ClientOwn Product
  • Built withNext.js 16 · TypeScript · React 19 · Hono.js · Node.js · MongoDB / Mongoose · TailwindCSS 4 · Clerk Auth · Zod · Radix UI · shadcn/ui Patterns · TanStack React Query · Framer Motion · Jotai · Axios · RSC / App Router · SSG + ISR · Secrets.js / Shamir's SSS · AES-256-GCM · CLI (Commander + Inquirer) · VSCode Extension API · Homebrew Formula · Winston + Loki Logging · Rate Limiting · IP Binding · RBAC / Token Scopes · Audit Trails / Activity Logs · Zero-Knowledge Architecture · Mintlify Docs · HKDF Key Derivation
Enver — hero
02/ Problem
The challenge

Every secrets manager says 'zero-trust' while storing your keys on their server. Enver was built to fix that at the protocol layer.

Existing platforms all share a flaw: somewhere inside a load balancer, an HSM, or a KMS pod, a key exists that can decrypt every secret in your account. Data breaches prove this every quarter. For Enver, the non-negotiable constraint was architectural: the server must be mathematically incapable of decryption. On top of that: the usual SaaS features teams actually need — environment scoping, team member management, audit logs, IDE integration, a CLI — had to work seamlessly without breaking the guarantee.

03/ Approach
The strategy

Split the master key on the client. Make the server a blind object store. If the database leaks, the attacker gets noise.

Every Enver secret follows the same dead-simple dance: (1) user types a plaintext value in the CLI, dashboard, or VSCode sidebar, (2) the client derives an AES key via PBKDF2-HKDF, (3) plaintext encrypts with AES-256-GCM, (4) the master key is split into 5 Shamir shares with a 3-share threshold, (5) ciphertext + 5 shares are shipped to the server as opaque blobs. Reconstruction needs 3 shares plus the user's lock key — the server alone holds 5/5 shares and still cannot decrypt. Every access layer on top (RBAC, IP binding, rate limits) is defense-in-depth, not the primary safety.

04/ Build
How it works

Four clients, one dumb API, a strict schema surface — and every security boundary enforced before a handler runs.

The stack is deliberately boring where it counts. The API layer is Hono with a middleware chain that runs: rate limit → Clerk session validation → token hash lookup → IP binding check → scope enforcement → Zod input validation — in that order, every request, short-circuiting on first fail. Mongoose schemas use immutable `ciphertext` and `share[]` fields so server code literally cannot accidentally write plaintext. The dashboard, CLI, and VSCode extension each embed the same crypto module to eliminate drift. A policy engine records every operation with structured `action` + `userId` + `projectId` events shipped to Grafana Loki via Winston; anything that touches a secret share is a first-class in the activity stream.

05/ Impact
The outcome

A 2-week MVP that passes the 'drop-the-database' test, with 4 integrations shipped and zero server-side decryption paths.

Enver v1.0 ships with a production Hono API, a Next.js dashboard, a Homebrew-distributed CLI (`ev`), and a VSCode extension — all four surfaces speaking the same protocol. A full audit of the server codebase yields zero call sites that can produce plaintext. Tokens are SHA-256 hashed, IP-bound, and rate-limited at 100 req/min/IP. The CLI decrypts entirely locally — pull 3 Shamir shares, reconstruct the key, and return the .env file without a server ever touching a cleartext value. Current roadmap: automated secret rotation, multi-region share mirroring, and native Vercel + GitHub Actions integrations.

(06) · Impact

The numbers tell the rest of the story.

  • 0

    Plaintext fields in database

  • 5/3

    Shamir threshold shares

  • 100/min

    Rate limit per IP

  • 4

    Shipped client surfaces