Never commit your secrets again.

Load secrets at runtime, manage them from one space, and share them securely with teammates.

existing-project

~/.sct/existing-project/secrets.sct

AUTH_SECRET
POSTGRES_URL
STRIPE_KEY

Each value has its own key in macOS Keychain. Send these to a teammate.

~/code/existing-project $ ls -A

boot.ts package.json

~/code/existing-project $ bun boot.ts

process.env inside the app

AUTH_SECRET	32 chars
POSTGRES_URL	48 chars
STRIPE_KEY	32 chars

Download for Mac Install the SDK

For Apple Silicon Macs.

1. Take .env out of the repo

One vault in ~/.sct holds them, outside every project folder.

Before

existing-project/
.envplaintext
STRIPE_KEY=sk_live_…
.env.localplaintext
.gitignore.env*
package.json
server.ts

Plaintext in the repo, one git add from a leak.

After

existing-project/
boot.tscalls loadEnv()
package.json
server.ts
~/.sct/existing-project/
secrets.sctencrypted
keysmacOS Keychain

No secret file in the project.

2. Load secrets when the app starts

npm install @sct/env

Read the SDK guide

boot.ts

import { loadEnv } from '@sct/env'import Stripe from 'stripe'
// Reads this project's secrets from macOS Keychain into process.env.await loadEnv({  onChange: () => console.log('process.env updated'),})
export const stripe = new Stripe(process.env.STRIPE_KEY)

What you need

Requirement	Why
macOS on Apple Silicon	The DMG comes from the latest GitHub release.
Node.js 22.18 or later, or Bun	The @sct/env SDK runs in server-side code.
The sct command on PATH	The SDK starts it. The SDK guide covers the setup.
A coding agent, if you use one	Agents use secrets through the sct CLI or MCP server. Each request opens an approval window on your Mac, and the agent never sees a value.

Get .sct for your Mac

The build is not notarized, so macOS blocks the first launch until you clear the quarantine flag.