feat: Implement Offline Secrets Manager with AES-256 Encryption #3

GreenHacker420 · 2025-10-11T05:52:56Z

🎃 Hacktoberfest 2025 Contribution

📝 Description

This PR implements a comprehensive offline secrets manager for ENV Storage Manager. As a developer, managing API keys, database credentials, and other secrets across multiple projects is frustrating and error-prone. This implementation provides a secure, encrypted, offline solution to centralize and protect all your environment variables.

✨ Features Implemented

🔐 Core Security

AES-256 Encryption: All secrets encrypted using Fernet (symmetric encryption)
PBKDF2 Key Derivation: Master password converted to encryption key using PBKDF2 with 480,000 iterations (OWASP recommended)
Secure Password Hashing: SHA-256 hashing for password verification
Salt Management: Unique salt per installation for additional security
Offline-First: All data stored locally in ~/.env_storage/, no cloud dependencies

📦 Storage Layer

SQLite Database: Local, file-based storage
SQLAlchemy ORM: Robust database management with proper relationships
Audit Logging: All operations logged for security tracking
Cascade Deletion: Deleting a project removes all associated secrets
Database Models: Config, Project, EnvVar, AuditLog

🎨 CLI Interface

Rich Terminal UI: Beautiful tables and colored output
Secure Input: Password masking for sensitive data entry
Interactive Commands: User-friendly prompts and confirmations
10 Comprehensive Commands:
- init - Initialize storage with master password
- create-project - Create a new project
- add - Add/update environment variables (with secure input)
- list - List projects or environment variables
- get - Retrieve specific variable with full value
- search - Search across all projects
- export - Export to .env file
- delete - Delete environment variables
- delete-project - Delete entire projects

🧪 Testing

40+ Test Cases covering:
- Encryption/decryption functionality
- Storage initialization and authentication
- Project and environment variable management
- Search and export features
- Edge cases and error handling
- Unicode and special character support

📁 Files Added/Modified

New Files:

src/crypto/encryption.py - Encryption/decryption logic (120 lines)
src/core/models.py - Database models (80 lines)
src/core/database.py - Database management (70 lines)
src/core/storage.py - Main storage interface (400+ lines)
tests/test_encryption.py - Encryption tests (150+ lines)
tests/test_storage.py - Storage tests (300+ lines)
main.py - Entry point
IMPLEMENTATION.md - Detailed documentation

Modified Files:

src/cli/main.py - Complete CLI implementation (250+ lines)

🏗️ Architecture

src/
├── crypto/
│   └── encryption.py      # Encryption/decryption logic
├── core/
│   ├── models.py          # SQLAlchemy database models
│   ├── database.py        # Database connection management
│   └── storage.py         # Main storage interface
└── cli/
    └── main.py            # CLI commands and interface

🔒 Security Considerations

Encryption at Rest: All secrets stored encrypted, never in plaintext
Master Password: Single password protects all secrets
No Password Recovery: Master password cannot be recovered (by design)
Audit Trail: All operations logged for security review
Secure Export: Warning displayed when exporting to .env files
Input Masking: Passwords and secrets masked during input

💡 Usage Examples

# Initialize
python main.py init

# Create a project
python main.py create-project -n myapp -d "My awesome app"

# Add secrets (will prompt for value securely)
python main.py add -p myapp -k API_KEY -d "OpenAI API Key"

# List all projects
python main.py list

# List project variables (values masked)
python main.py list -p myapp

# Search across all projects
python main.py search API

# Get specific variable (shows full value)
python main.py get -p myapp -k API_KEY

# Export to .env file
python main.py export -p myapp -o .env

✅ Checklist

Code follows project style guidelines
Comprehensive tests added (40+ test cases)
Documentation updated (IMPLEMENTATION.md)
Commit messages follow conventional commits format
No merge conflicts with main branch
All new code has proper docstrings
Security best practices followed
Type hints used throughout
Error handling implemented

🎯 Why This Matters

As developers, we face daily challenges:

🔍 Lost Keys: Forgetting where we stored API keys
🔄 Context Switching: Managing different .env files across projects
🔒 Security Risks: Accidentally committing secrets to version control
📦 Backup Nightmares: No centralized backup for critical credentials

This implementation solves all these problems with a secure, offline-first approach.

📊 Stats

Lines of Code: 1,600+ lines
Test Coverage: 40+ comprehensive test cases
Files Added: 8 new files
Files Modified: 1 file
Documentation: Extensive inline docs and IMPLEMENTATION.md

🚀 Future Enhancements

Potential improvements for future PRs:

Import from existing .env files
Backup/restore functionality
Browser extension for auto-fill
IDE integration plugins
Secret rotation reminders
Team sharing features

🙏 Notes

This is my Hacktoberfest 2025 contribution. I've put significant effort into making this a high-quality, production-ready feature that genuinely solves a real problem developers face daily.

Thank you for reviewing! 🎃

Implements a comprehensive offline secrets manager for securely storing and managing environment variables across multiple projects. Features: - AES-256 encryption using Fernet symmetric encryption - PBKDF2 key derivation with 480,000 iterations (OWASP recommended) - SQLite database with SQLAlchemy ORM - Master password protection with SHA-256 hashing - Audit logging for all operations - Rich CLI interface with beautiful terminal output - Comprehensive test suite with 40+ test cases Core Modules: - src/crypto/encryption.py: Encryption/decryption logic - src/core/models.py: Database models (Config, Project, EnvVar, AuditLog) - src/core/database.py: Database connection management - src/core/storage.py: Main storage interface and business logic - src/cli/main.py: Complete CLI implementation with 10 commands CLI Commands: - init: Initialize storage with master password - create-project: Create new projects - add: Add/update environment variables - list: List projects or variables - get: Retrieve specific variable - search: Search across all projects - export: Export to .env file - delete: Delete variables - delete-project: Delete entire projects Security Features: - Offline-first design (no cloud dependencies) - Encryption at rest for all secrets - Secure password input with masking - Audit trail for security review - Cascade deletion for data integrity Testing: - test_encryption.py: 20+ encryption tests - test_storage.py: 20+ storage and integration tests - Coverage for edge cases, unicode, special characters Closes #hacktoberfest Addresses the need for secure, centralized environment variable management

github-actions

🎉 Congratulations on your first Pull Request!

Thank you for contributing to ENV Storage Manager! This is an exciting moment for both you and our project.

What happens next?

🔍 Our CI/CD pipeline will run automated checks
👀 A maintainer will review your code
💬 We may request changes or ask questions
✅ Once approved, your PR will be merged!

Tips for success

✅ Make sure all CI checks pass
📝 Respond to review comments promptly
🔄 Keep your branch up to date with main
📖 Follow our Contributing Guidelines

Need help?

💬 Comment on this PR with questions
📚 Check our documentation
🤝 Join our Discussions

We're excited to have you as part of our community! 🌟

P.S. If this is for Hacktoberfest 🎃, make sure your PR follows the quality guidelines to be eligible!

curiouscoder-cmd · 2025-10-11T05:55:36Z

looks good to me

src/cli/main.py

+    storage = get_storage_manager()
+
+    try:
+        project = storage.create_project(name, description)


src/core/models.py

+"""
+
+from datetime import datetime
+from typing import Optional


src/core/storage.py

+
+from typing import Dict, List, Optional
+
+from cryptography.fernet import InvalidToken


src/crypto/encryption.py

+        Returns:
+            Hexadecimal hash string
+        """
+        return hashlib.sha256(password.encode()).hexdigest()


tests/test_storage.py

+"""Tests for storage module."""
+
+import os
+import tempfile


tests/test_storage.py

+
+import os
+import tempfile
+from pathlib import Path


tests/test_storage.py

+import pytest
+
+from src.core.storage import authenticate_storage, initialize_storage
+from src.crypto.encryption import EncryptionManager


github-actions bot reviewed Oct 11, 2025

View reviewed changes

curiouscoder-cmd assigned GreenHacker420 Oct 11, 2025

curiouscoder-cmd added enhancement New feature or request hacktoberfest hacktoberfest-accepted labels Oct 11, 2025

curiouscoder-cmd merged commit 6ceb2ae into curiouscoder-cmd:main Oct 11, 2025
31 of 34 checks passed

github-advanced-security bot found potential problems Oct 11, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: Implement Offline Secrets Manager with AES-256 Encryption #3

feat: Implement Offline Secrets Manager with AES-256 Encryption #3

Uh oh!

GreenHacker420 commented Oct 11, 2025

Uh oh!

github-actions bot left a comment

Uh oh!

curiouscoder-cmd commented Oct 11, 2025

Uh oh!

Uh oh!

Check notice

Check notice

Check notice

Check failure

Check notice

Check notice

Check notice

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		from typing import Dict, List, Optional

		from cryptography.fernet import InvalidToken

Uh oh!

feat: Implement Offline Secrets Manager with AES-256 Encryption #3

feat: Implement Offline Secrets Manager with AES-256 Encryption #3

Uh oh!

Conversation

GreenHacker420 commented Oct 11, 2025

🎃 Hacktoberfest 2025 Contribution

📝 Description

✨ Features Implemented

🔐 Core Security

📦 Storage Layer

🎨 CLI Interface

🧪 Testing

📁 Files Added/Modified

🏗️ Architecture

🔒 Security Considerations

💡 Usage Examples

✅ Checklist

🎯 Why This Matters

📊 Stats

🚀 Future Enhancements

🙏 Notes

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

What happens next?

Tips for success

Need help?

Uh oh!

curiouscoder-cmd commented Oct 11, 2025

Uh oh!

Uh oh!

Check notice

Check notice

Check notice

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check notice

Check notice

Check notice

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants