Secrets Management — tene

# Secrets Management — tene

This project uses [tene](https://github.com/tene-ai/tene) for secret management.
Secrets are encrypted locally with XChaCha20-Poly1305. No server, no cloud.

## Quick Reference

| Task | Command |
|------|---------|
| List available secrets | `tene list` |
| Get a secret value | `tene get <KEY>` |
| Get secret as JSON | `tene get <KEY> --json` |
| Set a secret | `tene set <KEY> <VALUE>` |
| Set from stdin | `echo "value" | tene set <KEY> --stdin` |
| Run with secrets injected | `tene run -- <command>` |
| Import from .env | `tene import .env` |
| Export to .env | `tene export` |
| Switch environment | `tene env <name>` |
| List environments | `tene env list` |

## Rules

1. **Never hardcode secrets** in source code, config files, or comments
2. **Never create .env files** — use `tene run -- <command>` to inject secrets as environment variables
3. **Access secrets via environment variables** — `process.env.KEY_NAME` (Node.js), `os.Getenv("KEY_NAME")` (Go), `os.environ["KEY_NAME"]` (Python)
4. **Use `tene list` first** to check what secrets are available before asking the user
5. **If a secret is missing**, tell the user to run: `tene set <KEY> <VALUE>`
6. **Use `--json` flag** for programmatic parsing: `tene get KEY --json` returns `{"name":"KEY","value":"...","environment":"..."}`
7. **Environment isolation**: secrets are scoped per environment (default, dev, staging, prod). Use `--env <name>` to target a specific environment

## Available Environments

Run `tene env list` to see all environments and which is active.

## Example Workflows

### Starting a new feature that needs an API key
1. Check if key exists: `tene list`
2. If not: ask user to run `tene set STRIPE_KEY sk_test_xxx`
3. Use in code via `process.env.STRIPE_KEY`
4. Run/test with: `tene run -- npm test`

### Running the project
```bash
tene run -- npm start          # Node.js
tene run -- go run .           # Go
tene run -- python main.py     # Python
```