Introduction
Zero-dependency, Go-only local secrets manager that eliminates plaintext .env files by storing secrets in an encrypted vault and injecting them directly into launched process memory.
MayFly wraps any command in a secure execution context that injects credentials directly into child process memory, eliminating plaintext .env files from your code repositories. It is engineered to neutralize supply-chain credential theft during package installations (npm install, pip install, cargo build), CI runs, and developer workflows with a tamper-evident cryptographic audit trail.
Core Principles
Two engineering principles distinguish MayFly from traditional secrets managers:
- Zero disk footprint: Decrypted secrets never touch physical disk storage. Credentials remain encrypted in binary format (
~/.mayfly/vault.enc) until process execution, where they are decrypted strictly into volatile RAM and passed directly into the child process environment table. - Host-native execution: MayFly uses host OS execution primitives (
os/exec) rather than intermediate shell wrappers (/bin/sh -c) or virtualized containers, ensuring your real build tools, real repository paths, and real local development workflows operate with zero overhead.
# 1. Store secrets in authenticated encrypted vault (AES-256-GCM)
mf set STRIPE_SECRET_KEY="sk_live_9a8b7c6d5e4f3a2b1c"
# 2. Inject secrets directly into child process memory (no .env on disk)
mf npm run dev
# 3. Cryptographically verify the SHA-256 audit log
mf audit verifyWhat MayFly Replaces
| Old Vulnerable Workflow | The MayFly Secure Workflow |
|---|---|
Storing .env or .env.local files on disk | Secrets encrypted at rest with AES-256-GCM in ~/.mayfly/vault.enc |
dotenv.config() in application code | Zero code changes: standard process.env / os.environ works natively |
Malicious npm postinstall reading .env | Subprocesses receive secrets only when explicitly launched |
| No visibility into credential reads | Tamper-evident SHA-256 hash chain logs every access and run event |
| Cloud secret manager latency and rate limits | Single 100% offline static binary with zero external dependencies |
Key Developer Use Cases
Full-Stack Local Development
Run Next.js, Vite, Express, Django, or FastAPI servers with mf npm run dev. No plaintext files on disk; RAM zeroed on exit.
Node.js Guide →
Supply-Chain Attack Defense
Run npm install or pip install safely. Malicious postinstall scripts find zero secrets to steal.
Threat Model →
CI/CD & Docker Builds
Inject secrets into ephemeral CI test suites and Docker containers without burning credentials into layer caches or test logs.
Docker Guide →
Monorepo Inode Isolation
Switch between dozens of services. Filesystem inode binding ensures the right secrets automatically load per folder.
Inode Architecture →
Start Here
Why MayFly?
The supply-chain threat model MayFly addresses, where it fits, and how it compares to .env and cloud vaults.
Quickstart
Install MayFly, initialize a project vault, and execute your first application in under two minutes.
Concepts
Learn how Linux inode project identification, in-memory execution, and the audit hash-chain operate.
Security Model
Explore PBKDF2-HMAC-SHA256 key derivation, AES-256-GCM AEAD encryption, and memory safety guarantees.