1
Initialize Vault
Binds current directory to its own encrypted key space.
$mf init
Never store passwords in .env files again.
MayFly keeps your API keys in an encrypted local vault. When you start your app (mf npm run dev), MayFly injects them straight into memory and wipes them when you finish.
Zero plaintext files on your hard drive, zero cloud dependencies, and zero third-party packages.
100% Go Standard LibraryAES-256-GCM + PBKDF2Deterministic BuildAGPL-3.0 License
INSTALL30-Sec Guide
Works on bash, zsh, fish (installs mayfly & mf to ~/.local/bin)
Single ~12MB standalone binary. Gives you both
mayfly and mf.$mf set STRIPE_SECRET=sk_live_51Msz...
[saved] Secret STRIPE_SECRET encrypted to vault
$mf npm run dev
[mayfly] unlocked vault in memory (aes-256-gcm)
[mayfly] injected 3 secret(s) directly into process RAM
> my-app@0.1.0 dev
> next dev
▲ Next.js 15.5.24
- Local: http://localhost:3000
[ready] in 1.4s (Secrets loaded from RAM)
$cat .env
cat: .env: No such file or directory (Protected against disk scrapers)
Direct OS In-Memory InjectionAES-256-GCM + PBKDF2
Simple 4-Step Workflow
Full Quickstart GuideHow to use MayFly in 30 seconds.
Initialize your folder, save your secrets, run your app, and verify the tamper-proof security log.
2
Save Secrets
Encrypts your variables with AES-256-GCM without disk writes.
$mf set STRIPE_KEY
3
Run Your App
Spawns your app with secrets injected directly into volatile RAM.
$mf npm run dev
4
Verify Audit
Mathematically validates the cryptographic SHA-256 hash log.
$mf audit verify
VISUAL DASHBOARDPrefer an interactive terminal dashboard? Just run:
$mf
Developer Workflows
Built for real-world scenarios.
How modern engineering teams and independent developers use MayFly to secure their environments.
Web & Backend Apps
Local Development & Hot-Reload
Run Next.js, Vite, Django, Express, or FastAPI with secrets injected strictly into memory. When the dev server shuts down, volatile RAM is zeroed.
Supply-Chain Defense
Untrusted Package Installs
Protect against malicious npm postinstall or Python setup scripts that scan disks for .env files and exfiltrate API keys before you even launch your app.
DevOps & CI/CD
CI Test Runners & Docker
Pass credentials to ephemeral CI test runners and containerized builds without burning plaintext API tokens into disk caches or image layers.
Hardware Inode Binding
Multi-Project & Monorepo Isolation
Seamlessly switch between multiple microservices or client repositories. Secrets automatically bind to the folder inode without manual profile switching.
Codebase Auditing
Plaintext Credential Crawling
Scan your entire codebase, configuration files, and legacy projects for hardcoded tokens, OpenAI keys, or orphaned .env files in milliseconds.
100% Offline & Air-Gapped
Air-Gapped Workstations & Flights
No cloud accounts, no API rate limits, and zero internet requirement. Work securely on airplanes, remote locations, and strict air-gapped networks.
The Security Challenge
Why .env files create supply-chain risk.
Third-party install scripts execute with local user permissions during build and install steps.
Plaintext .env Exposure
Traditional Development
- [x]Unencrypted on Disk: Passwords and API keys sit in plain text where local processes can read them.
- [x]Install-Time Exfiltration: Malicious
npm postinstallscripts scan drives for credentials before your app runs. - [x]Accidental Git Commits: An unintended
git add .risks exposing production secrets to remote repositories. - [x]No Audit History: Traditional files provide zero tamper-proof record of which process accessed secrets.
The MayFly Architecture
In-Memory Secret Injection
- [ok]Zero Files on Disk: Secrets are strictly encrypted with AES-256-GCM at rest. No plaintext file touches storage.
- [ok]Direct RAM Injection: Secrets reside in volatile process memory while active, and buffers are wiped upon exit.
- [ok]Folder Inode Binding: Secrets are bound to your folder’s filesystem identity, preventing cross-project leaks.
- [ok]Tamper-Proof Audit Trail: Every secret access is signed into a cryptographic SHA-256 hash chain.
Zero-Dependency Architecture
Core Subsystems in Pure Go Stdlib
Every subsystem was implemented from first principles using standard library primitives to eliminate upstream supply-chain risk.
godotenv / dotenv10.4M+ weekly
In-Memory Process Injection
Stops saving .env files on disk
Instead of saving API keys in readable plaintext files on your SSD, MayFly loads them directly into your app’s memory and zeroes memory buffers upon exit.
Built with: os.Environ, os/exec.CommandContext, RAM zeroing
Source: pkg/executor/process.go
golang.org/x/crypto/pbkdf25.2M+ weekly
Key Derivation Function (KDF)
Standard password key derivation
Hand-rolled the official RFC 8018 password algorithm with 600,000 security rounds so your master password cannot be brute-forced by GPUs.
Built with: crypto/hmac, crypto/sha256, encoding/binary
Source: pkg/vault/kdf.go
bubbletea / tview1.5M+ weekly
Terminal UI Engine
Interactive visual dashboard
Built a lightweight 2D double-buffered terminal interface from scratch using standard operating system calls, without heavy UI framework packages.
Built with: syscall.SYS_IOCTL (termios), bytes.Buffer, 2D Canvas
Source: pkg/tui/
fatih/color / chalk300M+ weekly
Terminal Styling & Colors
Clean, accessible terminal colors
Built-in 16-color ANSI sequence builder with bold, dim, and underline modes that automatically respects accessibility and NO_COLOR rules.
Built with: Raw ANSI SGR builders, os.Getenv("NO_COLOR")
Source: pkg/tui/terminal/terminal.go
atotto/clipboard800k+ weekly
System Clipboard Controller
One-key secret copying
Uses native terminal clipboard escape codes (supported in iTerm2, Alacritty, Kitty, Windows Terminal, VS Code) to copy secrets safely without native plugins.
Built with: encoding/base64, ANSI OSC 52 escape sequences
Source: pkg/tui/terminal/clipboard.go
trufflehog / gitleaksMulti-tool staple
Plaintext Credential Scanner
Finds accidental password leaks
Built-in code crawler that scans your project for accidentally hardcoded API keys or unencrypted .env files, respecting your .mayflyignore file.
Built with: path/filepath.WalkDir, regexp, bufio.Scanner
Source: pkg/scanner/scanner.go
Cryptographic Build Determinism
100% Deterministic Binaries
Build MayFly twice on any machine using make reproducible to independently verify byte-identical SHA-256 cryptographic hashes.
Published SHA-256 Binary Checksum:
34a93967e7a8dbdadc649dbfeecde1d36b816e3627aed480c09876e8acb582ec
Flags:
-trimpath -ldflags="-s -w -buildid="Core Capabilities
Security, Performance & Efficiency
Engineered for robust local credential management with zero runtime dependencies.
Zero Plaintext on Disk
Unencrypted secrets never touch storage. Decrypted credentials exist exclusively in ephemeral process memory while your app runs.
AES-256-GCM + PBKDF2
Authenticated encryption with 600,000 security rounds ensures your vault remains protected against offline GPU brute-force attempts.
Hardware Inode Isolation
Secrets are automatically bound to the physical storage device and directory inode, preventing accidental project cross-contamination.
Native Process Spawning
Spawns your processes directly via operating system primitives (os/exec) without subshell wrappers, keeping your terminal history clean.
Tamper-Proof Audit Trail
Every secret read, write, or execution is signed into a cryptographic SHA-256 hash chain so unauthorized tampering is immediately detected.
100% Local & Offline
No cloud accounts, no network daemons, and zero third-party packages. Operates completely locally on your workstation.
Technical Comparison
Architectural Comparison
How MayFly compares to traditional plaintext .env files and cloud secret managers.
←Swipe horizontally to view full matrix→
Zero-Dependency Audit
100% Go Standard Library
MayFly contains zero third-party packages in its dependency manifest. Run go list -m all on the repository to verify that only standard library packages are used.