MyDataGit brings Git-like versioning, multi-environment branching, and compare-across-environments to your .env files, credentials, and project state — with zero plaintext on any cloud server.

Create Free Vault → Read the docs GitHub ↗

npm install -g @mydatagit/cli

mdgit · live demo

$ mdgit init Initialized empty MyDataGit project in /app/.mydatagit Add files to track in .include, then use 'mdgit status'. $ echo ".env" >> .include && mdgit push Encrypting .env with PDK (AES-256-GCM + 96-bit nonce)... Uploading encrypted ciphertext to Backblaze B2... ✓ Pushed 1 file. Snapshot 01J5X98... created on origin/main.

$ mdgit status On branch: main Linked remote: production-vault (01J5K789...) Modified: ∼ .env (contents masked for zero-knowledge security) New files: + secrets/api-credentials.json

$ mdgit branch compare dev prod Comparing 'dev' → 'prod': + .env.local (new encrypted state) ∼ .env (fingerprint modified) $ mdgit branch promote dev prod --yes ✓ Successfully promoted 'dev' → 'prod' (snapshot 01J5M42...).

$ mdgit device list REQ_ID DEVICE_PUBLIC_KEY STATUS req_019a8 a7f82b... (MacBook-M3-Pro) pending $ mdgit device approve req_019a8 Unwrapping PDK with local device key and re-wrapping for target... ✓ Approved device request 'req_019a8'.

$ mdgit project recover 01J5K789... Enter your 24-word recovery mnemonic: abandon ability able about above absorb abstract absurd abuse access accident... ✓ Successfully recovered project '01J5K789...'. PDK unwrapped and granted to this device. Run 'mdgit pull'.

AES-256-GCM

Authenticated encryption

HMAC-SHA256

Key-derived content hash

X25519 ECIES

Device public key grants

BIP-39 Mnemonic

24-word disaster recovery

Cloudflare D1

Zero-plaintext metadata

Backblaze B2

Encrypted object storage

The Paradigm Shift

Why secrets broke Git — and how MyDataGit fixes it.

Secrets are fundamentally a version-control problem. Existing solutions either leak credentials or break developer workflows.

Raw Git Commits

One accidental git add . embeds production secrets in repository history forever. Rewriting history is painful and leaks remain cached.

Centralized Vault SaaS

Plaintext credentials sit in a third-party cloud database. Any infrastructure compromise or provider insider threat exposes your secrets.

Pasting via Slack or Notion

Environment drift between team members, zero branch awareness, no audit trail, and outdated keys cause obscure deployment failures.

MyDataGit Zero-Knowledge

Client-side AES-256-GCM encryption, fresh 96-bit nonces, branch comparison with secret masking, and the server never sees plaintext.

Cryptographic Architecture

Zero plaintext reaches the cloud. Verified by math.

Your device derives cryptographic keys, computes HMAC hashes, and encrypts payloads before any byte leaves your machine.

1 · Local Device Client Side

Plaintext • `.env`

Tracked files are read locally. The Project Data Key (PDK) encrypts each file with fresh AES-256-GCM nonces.

2 · Integrity HMAC-SHA256

Content Verification

Content identity is bound to (content_hash, pdk_generation) preventing ciphertext tampering and replay attacks.

3 · Server Side D1 + B2

Opaque Cloud Gateway

Cloudflare D1 stores version metadata; Backblaze B2 stores encrypted ciphertext blobs. The server sees only opaque bytes.

Engineered Capabilities

Security you can prove. Tooling your team already knows.

Built from the ground up for software teams, DevOps engineers, and CI/CD pipelines.

.include Declarative Allowlist

Explicit allowlist syntax with [global] and [branch:name] sections. No accidental leaks, zero guesswork.

Client-Side AES-256-GCM

All file contents are encrypted locally with 96-bit nonces. Keys never touch cloud memory.

Git-Native Multi-Branching

Branch, compare, and merge across dev, staging, and prod with automated secret masking.

X25519 Device Key Approvals

New teammate machines generate key pairs and queue for Owner/Admin cryptographic approval.

24-Word Disaster Recovery

BIP-39 recovery mnemonic allows 1-command vault restoration even if all machines are lost.

Scoped CI/CD Service Tokens

Generate scoped service account tokens locked strictly to specific branches (e.g. prod only).

Developer Workflow

From zero to encrypted production in 4 simple commands.

Predictable commands that mirror Git workflows with built-in zero-knowledge cryptographic safeguards.

01

Install CLI & Authenticate

Install globally from npm and initialize your cryptographic device identity.

npm install -g @mydatagit/cli
mdgit auth signup --email dev@company.com --password "StrongPass!"

02

Configure .include & Track Secrets

Declare global and branch-specific secrets in .include with directory recursion.

mdgit init
echo "[global]" >> .include
echo "docs/context.md" >> .include
echo "[branch:dev]" >> .include
echo ".env" >> .include

03

Create Remote Project & Push

Create your project vault and push encrypted ciphertext. Receive your 24-word recovery phrase.

mdgit project create backend-vault
mdgit push

04

Branch, Compare & Promote

Compare differences across environments and promote changes with compare-and-set protection.

mdgit branch compare dev prod
mdgit branch promote dev prod --yes

Ready for Zero-Plaintext Security?

Put your project secrets under cryptographic control.

Free for developers and open-source teams. No plaintext on servers, ever.

Create Free Account → Explore CLI Docs

Version control for the secrets and state Git ignores.