Are my secrets safe?

Your secrets are never sent anywhere. Dotvault has no account, no sync and no server holding your files, and no request it makes carries the contents of an env file, a key name, a value or a path.

Two things are worth being precise about. Snapshots are encrypted with AES-256-GCM, each with its own initialisation vector, using a key held via Electron’s safeStorage API and protected by the macOS Keychain. Your .env files themselves are not encrypted, because your framework, your test runner and your Docker build all have to read them.

The app does make network requests, for update checks and licence revalidation, plus optional telemetry if you turn it on. Every one of them is listed on the security page, along with what Dotvault deliberately does not protect you from.