case study · designer & engineer, solo · 2026 — present

Pyxis.Know what's in your .env files.

Personal project · macOS

Pyxis is a local-first inventory and vault for the environment variables already scattered across a developer's disk. macOS, CLI first, with a menubar app. No accounts, no server, no network — ever.

It started from a question nothing answers: what do I already have? The same Stripe key in three projects, a .env.production committed months ago, a live secret behind a NEXT_PUBLIC_ prefix that a bundler will happily ship to every browser. pyx doctor answers that read-only, with no vault and no passphrase, and adopt takes the files in byte for byte without touching the originals.

Once it holds something, pyx run injects an environment into a process without anything touching disk, and the inventory commands — search, which, dupes, stale, orphans — work with the vault locked, because only the values are sealed.

stack

Rust
Tauri
SQLite
Argon2id
XChaCha20-Poly1305
HKDF
HMAC-SHA256
macOS Security
clap
cargo-fuzz

An inventory, not just a vault

Key names, projects and services are plaintext and searchable; values are sealed. Duplicates are found by keyed HMAC fingerprint, so pyx dupes matches equal secrets across projects without decrypting a single one.

Standard crypto, one module

Argon2id wraps a random 32-byte data key; HKDF separates the value, fingerprint and audit keys; XChaCha20-Poly1305 seals each value bound to its vault, environment and row, so a blob moved between rows fails to open.

No network, provably

No HTTP client anywhere in the dependency graph, enforced in CI, and #![forbid(unsafe_code)] across the workspace. A separate agent holds the key and checks its callers' code signatures. 174 tests, plus fuzzing.

the work

pyx doctor output: a live Stripe key behind a NEXT_PUBLIC prefix, a committed .env.production, duplicated values — pyx doctor — read-only, no vault, no passphrase: what you already have and which of it is a problem.

pyx dupes output: one Stripe key in three places — pyx dupes — the same value in three projects, found by fingerprint, nothing decrypted.

pyx search stripe output listing four Stripe keys — pyx search — over names, services and projects, with the vault locked.

pyx diff output: one key on disk but not in the vault — pyx diff — vault against the file on disk, without opening a value.

pyx adopt output: six env files taken into the vault, originals untouched — pyx adopt — six files in, byte for byte; the originals stay until cleanup proves the vault can reproduce them.

pyx inspect output: which columns are plaintext and which are sealed — pyx inspect — exactly what the vault file reveals to someone without the key.

Want the full story?

rchardnjoku@yahoo.com ↗← back to all projects