Before I get started, let me tell you why I built Varsync. If you’re like me, a dev who has a lot of (unfinished) side projects, you probably also have a lot .env files which you use to manage feature flags/configs/secrets that you copy-paste between projects and environments. When you have to, say, toggle a feature flag, or change the rate limit on a server, you have to manually update the env variables and redeploy the app. Sometimes when you deploy, you might forget to update the .env files which might cause the deployment to crash (happened to me more than once).
This annoyed me a lot. I wanted a single solution using which I can
So I built Varsync. Now let’s explore how it works.
Before you can store/access secrets in Varsync, you must set up a master password for the vault. This is different from the account password and is separate for every project. If you forget the master there’s no way to recover it. You have to reset it which will erase all the encrypted variables in your project. But unencrypted variables will remain.
The master password is hashed with the PBKDF2+SHA256 algorithm on the client side using the user’s email address as salt. The hash is then sent to the server where it is again hashed with scrypt and a randomly generated salt and stored in the database. This ensures that the master password is not compromised in transit and in storage.
