Every release of Dotvault, newest first. These are the same notes you get in the app when it updates. I ship small and often, so most of them are short.
1.5.0
Syncing keys into another file now leaves a snapshot on the target, so you can undo a sync you did not mean to make. It appears in the History tab alongside your saves, named for the file the keys came from, and a sync of ten keys is one entry rather than ten.
The comment Dotvault writes above synced keys now names the file they came from. It always said .env, whichever file you had actually synced from, which is the wrong answer to give anyone working out where a value came from.
A real credential under a framework's public prefix now gets its own warning. Anything under NEXT_PUBLIC_, VITE_, GATSBY_ and the other public prefixes is compiled into the browser bundle, so a Stripe secret key or an AWS access key sitting there can be read by anyone who loads the page. That is true whether or not the file is gitignored, which is why the exposed-secret badge never caught it. Publishable keys and browser API keys are left alone, because they are meant to be public.
1.4.0
Settings now names the tier your licence was bought as and what it covers, so you can see at a glance whether you have room for another developer. It also explains the machine count: every tier gives each developer two machines, which is why a Team (5) licence shows ten slots and not five.
Ghostty is now one of the terminals you can pick in Settings, so Open in Terminal opens it in your project directory.
The missing-variables banner has stopped nagging you about optional integrations. It flagged FLARE_KEY on every Laravel project, AWS keys on anything using an AWS SDK, and a Stripe secret on anything with the SDK installed — warnings you could only clear by signing up for something. It now lists only the variables your app genuinely will not start without, like APP_KEY or a database URL, and the heading says where the expectation came from. Everything else is still described in the editor and still offered when you generate a file.
1.3.0
Renewing your update window no longer means a new licence key. Buy a renewal and the date behind the key you already have moves, so there is nothing to paste anywhere. Dotvault picks the new date up within a week, or straight away from Check for Updates.
Settings now has a Renew updates button, whether or not your window has closed. Renewing early adds the twelve months to the end of what you already have, so it costs you nothing to do it in good time.
1.2.0
Settings now tells you when your twelve months of updates run out, and afterwards how many releases have shipped since that date. Nothing changes when that date passes except which releases Dotvault offers you: the version you own carries on working, with no lock and no read-only mode.
Settings also shows how many of your licence's machine slots are in use, so you can tell at a glance whether you have room for another Mac.
If you check for updates after your update window has closed, Dotvault now says so and names the release it is holding back, instead of saying nothing at all.
Corrected the in-app FAQ where it was overstating things. It said your secrets never leave your machine full stop, which glossed over the update check and the weekly licence check; it said your encryption keys sit in the macOS Keychain, when they are encrypted with safeStorage and it is safeStorage's own key the Keychain holds; and it still described a 30-day offline grace window that no longer exists. Your .env files still never leave your machine, which was never the bit in doubt.
Staging an env file in Git and then editing it again no longer drops you onto the error screen. The status badge in the editor header had no label for that combination and fell over when it hit one.
1.1.1
Dotvault is now priced in US dollars, with team licences for 5 and 10 developers alongside the single-developer option. Every licence includes twelve months of updates and never expires, so the version you own keeps working whether or not you renew.
Being offline no longer costs you your licence. Dotvault used to lock the app and delete your licence after 30 days of failed checks, which meant a long stretch offline, or an outage at my end, could shut you out of your own secrets. It now stays licensed however long the checks fail for, and keeps your licence on disk so there's nothing to reactivate when you reconnect. Only the licence server actually saying a licence is no longer valid will lock the app.
1.1.0
Dotvault is now Apple Silicon only. Apple stops supporting Intel Macs with macOS 27 this autumn, so the Intel build has been retired. If you're on an Intel Mac the version you already have keeps working, it just won't get updates any more.
1.0.3
Dotvault now runs on a much newer version of Chromium, picking up three major releases of security fixes. Nothing changes in how you use the app, it's just a safer engine underneath.
1.0.2
Fixed the Dotvault icon appearing larger than other icons in the Dock.
1.0.1
Fixed Laravel encrypted env files so Laravel can decrypt them again. Files saved in the standard format weren't written in the exact shape php artisan env:decrypt expects, so deployments could fail with an unserialize error. Open any affected encrypted file and save it again to repair it.
1.0.0
First release. Welcome to Dotvault.
Updates arrive in the app automatically. If you'd rather know exactly how that works, I've written it up.
I use cookies for analytics, to see how people use this site. Learn more