What Building EnvBox Taught Us

What I set out to learn

I chose this project because a portfolio marketing site never forces these topics in a serious way:

• Authentication and authorisation — who you are, and which environments you may see
• An ORM and a real database — Drizzle and PostgreSQL instead of mock-only data
• How Node packages are built — and how a terminal CLI parses commands and talks to a server

Those were the learning goals. The .env pain was the reason the learning would ship as something usable.

What it gave us in practice

After EnvBox, the same ideas showed up whenever a later project needed a database or shared environment configuration. My brother and I used EnvBox itself on those projects; the join-and-pull loop was simply more pleasant than sending keys through chat again.

Concrete takeaways:

• Accounts, roles and time-limited access are no longer abstract. Invite tokens, hashed keys and environment scopes are patterns we can reuse when a client needs controlled access — see Custom Feature Development.
• Test the sensitive path first. Unit tests around encryption and key material beat a large suite that never touches the dangerous code.
• Publishing to npm is a product surface of its own: versioning, local testing of the CLI, and the difference between “works in the monorepo” and “works after npx.”

If I started the UI again today I would apply stricter typing and frontend structure habits we use now on client work. The overall shape of EnvBox — dashboard plus CLI plus scoped invites — is still the design I would keep for this problem size.

Where it stands

EnvBox remains an MVP. We use it. It is open source. It is not positioned as a finished commercial competitor to full secrets platforms.

The useful story for Bscenius is not “we built the ultimate secrets product.” It is: we picked a real annoyance, shipped a small tool in about three weeks, learned auth and packaging properly, and kept using the result.

Try it or read the code

• Source on GitHub
• envbox-cli on npm
• Project card

If you are evaluating how we approach custom features and access control on client projects, start from the services overview or book a short discovery call from the site.