No more .env files
redact run gives a command its variables for one environment, and nothing lands on disk.
Products
Open source

Keys your agents can use, never read.
A native Mac vault for developer secrets. Keys stay encrypted behind Touch ID, projects get their variables at run time instead of from .env files, and every folder knows which cloud account it deploys to.

redact run gives a command its variables for one environment, and nothing lands on disk.
When an AI agent asks for secrets, you approve with Touch ID: once or for 15 minutes.
Any value that prints comes out as [redact:NAME], so it never enters an agent's context.
Bind folders to Cloudflare, GitHub, Vercel, Supabase or AWS accounts. wrangler deploy just goes to the right one.