Skip to content
Zain Mahmood
Contact
Selected work

Envryn

.env files get committed, copied and left behind. Cloud secrets managers fix that by asking you to trust another company with the keys. Envryn keeps an encrypted vault on your own devices and syncs Windows and Android directly over the local network, with no account and no relay server.

Type
Security tool
State
Beta · v0.2.0
Role
Solo, end to end
  • Rust
  • Tauri
  • React
  • TanStack Router
  • XChaCha20-Poly1305
  • Argon2id
Envryn Android vault

At a glance

  • Rust core; the UI is treated as untrusted
  • Windows and Android sync with no server in between
  • No HTTP client; suggestions are deterministic and offline

What I owned

Solo project. The Rust vault core and cryptography, the Tauri shell, the React interface, the Android build, the paired-device sync protocol, and the CI security tooling around all of it.

Decisions, and what they cost

  1. The interface is treated as untrusted—and the vault has no HTTP client

    A webview UI is the easiest place for a bug to leak a secret, so it never gets to decide anything. Sensitive operations cross a typed Tauri boundary and are enforced by the Rust core, and the TypeScript bindings are generated from the Rust IPC types so the two sides cannot drift apart. Version 0.2 removed the local AI worker and every HTTP client; the only network traffic the app can make is direct sync with a paired device on the local network.

    What I gave upEvery feature touches three places: a Rust command, the generated contract, and the UI. Name and type suggestions are now deterministic rules covering more than 70 key formats; an unknown value stays Unknown instead of being guessed.

  2. Direct device sync instead of a hosted relay

    Devices pair with a code a human compares on both screens, then sync encrypted records over mutually authenticated TLS on the local network. Nothing sits in the middle, so there is no server holding ciphertext, metadata or an account list.

    Where your secrets travel between devices

    1. Cloud secrets manager (not used)

      DeviceVendor's serverDevice

      Someone else holds the ciphertext, the metadata and the account list.

    2. Envryn

      WindowsMutual TLS, local networkAndroid

      Paired with a code you compare on both screens. Nothing in the middle.

    What I gave upSync only happens when both devices are on the same network. There is no cloud fallback to reach for when you are away from home, because adding one would bring back the thing Envryn exists to avoid.

  3. Separate keys for separate jobs

    The master password goes through Argon2id, records are sealed with XChaCha20-Poly1305, and HKDF-SHA256 derives domain-separated subkeys so a key made for one purpose is never reused for another. On Windows, DPAPI and Windows Hello add optional platform protection on top.

    What I gave upThere is no account, so there is no account recovery. Lose the master password and nobody, including me, can open the vault. Encrypted backups are the answer to that, not a reset link.

Known limitations

  • Windows installers do not have a trusted publisher signature yet, so SmartScreen warns. Every release carries CHECKSUMS.txt to verify against.
  • Android has less physical-device coverage than Windows.
  • No automatic updater in the 0.1.x series; you install a newer build over the old one.
  • It has had an internal security review, not an independent audit, and the README says so.

Where it stands

Public beta. v0.2.0 adds automatic 30-second paired-device sync, reliable phone-to-PC discovery around WSL, Hyper-V and VPN adapters, project deletion that syncs, and native Save/Open dialogs for backups on Windows and Android. Windows .exe and .msi installers plus a universal Android APK ship with checksums. CI runs unit, integration and fuzz targets alongside CodeQL, Semgrep, GitGuardian, Snyk Code, OSV-Scanner, cargo-audit and cargo-deny.