The first hire needs the keys on day one
Two people is the point where "just send it to me" stops being a workable process, and it is also the point where nobody has time to set up anything better.
- The setup
- Founder plus first engineer. Shared production account. No IT function.
- In play
- Shared provider accountsChatOne production environment
On day one the new engineer needs about a dozen keys to get the app running locally. The fastest route is a chat message with all of them, and the fastest route is what happens under deadline.
Two people is early enough that a secrets platform feels absurd and late enough that the informal method has real consequences — there is exactly one production environment and both of you can break it.
What breaks
The onboarding message is permanent
A single chat message containing twelve production keys sits in the workspace history, in the export, and in the search index. It stays there long after either of you remembers sending it.
Divergence starts immediately
A key rotated by one person is not rotated in the other person’s .env. The next hour is spent debugging an auth error that is actually a stale copy.
There is no answer to "who has access"
It is fine at two people. It stops being fine at four, and by then a year of ad-hoc sharing has to be reconstructed from memory.
How it works here
Share the project, not the values
The new engineer is added to an encrypted project. The keys are re-encrypted to their public key on your machine; the server relays ciphertext it cannot open.
They generate their own .env
Instead of a chat message with twelve values, they unlock the vault and generate the file. No key is ever pasted anywhere.
Membership is a list you can look at
Who is in a project is explicit from the start, so the question that becomes unanswerable at four people never gets a chance to.
Removal rotates the key
If someone leaves, revoking them rotates the project key and re-wraps it for whoever remains. It is a cryptographic change, not just a permission row.
Closest to your setup?
Install the extension, import an existing .env, and check the fit against your own projects. It works offline and nothing is uploaded unless you sign in.