Why isn't Dotvault open source?

Because it is a paid product built by one person, and the licence revenue is what pays for the time that goes into it. That is the whole answer, and I would rather give you that than dress it up.

The question underneath it is usually a better one: how do you trust software you cannot read with the contents of your .env files? Reading the source would not settle that anyway, since you would still be running a binary somebody else built. What actually helps is being able to check the behaviour.

So: Dotvault is signed with an Apple Developer ID and notarised by Apple, which means it has been through Apple’s automated checks and cannot be modified after the fact without breaking the signature. It has no account, no cloud storage and no sync service, so there is no infrastructure of mine for your secrets to end up on. The security page lists every network request the app makes, including what each one carries, and it is deliberately more careful than marketing copy usually is. If you want to verify that list rather than take it on faith, a firewall tool like Little Snitch will show you exactly what the app talks to.

That is a stronger position than “the source is on GitHub”, and it is one you can check in an afternoon.