Shelve

Environment variables end up scattered across dotenv files, chat messages and CI settings, and nobody is certain which copy is current. Shelve centralizes them in one vault organized by project and environment, then gives you the tooling to pull them back into a terminal or a pipeline on demand.

Secrets are hashed with SHA-256 and encrypted with AES-256 at rest, and environments such as development, staging and production sit alongside any custom ones you define. The stack is Nuxt with Nitro on the server and PostgreSQL through Drizzle, with the interface built on Nuxt UI.

Most of the design effort went into how a developer actually reaches a secret.

• CLI: pull, push and inject secrets straight into a process from the terminal.
• Command palette: search, navigation and actions from a single keyboard shortcut.
• GitHub sync: repository and Actions secrets stay aligned through the official GitHub App.
• Secure sharing: a built-in vault issues time-limited links for handing a secret to someone.
• Workspaces: teams organize projects under owner, admin and member roles.
• Zero config: projects are detected automatically and defaults are filled in.

Shelve is Apache 2.0 licensed with no core features held back, and self-hosting is documented for a Vercel deployment. The roadmap points at configuration sync across several repositories, deeper platform integrations and workflow automation, on the way to what its author calls a unified developer workspace.