Your Secrets Are Now Encrypted at Rest

A product whose pitch includes "govern your secrets" has no business storing those secrets as plaintext — so before opening OneEnv up, we closed exactly that gap. Every environment value is now encrypted at rest with AES-256-GCM: the shared master values, every service's synced copy, both override slots, and the value diffs inside change events. A leaked database backup no longer equals a secret dump.

Where the encryption lives

Not scattered across route handlers. The encryption is a single custom column type at the ORM boundary — values encrypt on the way into Postgres and decrypt on the way out, transparently to every read and write path in the codebase. That design choice matters: there is no code path that can accidentally write a secret in plaintext, because the column itself won't allow it.

The rest of the secret-handling story

What we're saying out loud

Two honest caveats, because publishing them is cheaper than a user discovering them: historical copies of values inside already-merged branch snapshots are on the fast-follow list for the same treatment, and encryption at rest protects a stolen backup, not a compromised server that holds the key. Security claims should be specific or they're marketing. The broader trust model — who can read, who can write, who can approve — is covered in Roles, Permissions & Trust.