Shelve

Shelve isolates application secrets using per-project envelope encryption, sealing distinct AES-256 data keys under a central platform key so security boundaries match project boundaries. Built on Nuxt and PostgreSQL, the platform injects sensitive environment variables directly into process memory through a command-line interface instead of writing plaintext configuration files to disk. It pairs local runtime injection with automated synchronization to GitHub Actions, updating repository secrets directly from a centralized dashboard.

Why Shelve instead of Doppler

Doppler manages secrets at enterprise scale by connecting a centralized vault to broad cloud ecosystems like AWS, GCP, Azure, and Kubernetes. Adopting Doppler means accepting a commercial multi-tenant cloud with per-seat billing and extensive infrastructure controls. For organizations running complex multi-cloud topologies, Doppler's broad connector matrix justifies the SaaS footprint.

Shelve prioritizes developer speed and GitHub-centered delivery. Instead of managing third-party cloud connections, it streamlines local workflows: testing code via memory injection with shelve run and syncing staging or production values directly into GitHub Actions repository secrets through an official GitHub App. Doppler remains better suited for teams needing dynamic credential rotation or automated Kubernetes operator deployments, but Shelve fits teams that want an open-source, self-hosted secret hub tightly aligned with their code repository.

What it does well

• Memory-only injection: The CLI command shelve run passes environment variables directly into process memory, keeping plaintext keys off local disks and out of shell histories.
• GitHub Actions synchronization: An official GitHub App mirrors environment variables directly to repository and organization secrets for continuous integration.
• AI assistant safety: Automatic generation of .cursorignore, .aiderignore, and .codeiumignore prevents local coding models from reading sensitive keys into prompts.
• Per-project envelope encryption: Independent data encryption keys sealed by a master key ensure compromised credentials remain isolated to a single project.
• Ephemeral sharing: A built-in Vault utility creates password-protected, encrypted links with custom view counts and expiration timers for one-off credential handoffs.