Every team has done it. A new dev joins, can't run the app, and asks the question that quietly creates a security incident: "can someone send me the .env?" Two minutes later, your production secrets are pasted into a chat.
Why the Slack handoff is dangerous
It feels harmless because it's so normal. But that message:
- lives forever in chat history and search — long after the dev leaves;
- syncs to every device, backup, and third-party integration your workspace has;
- is impossible to rotate or revoke — once it's out, it's out;
- has no audit trail — you can't say who accessed what, or when.
Multiply that by every client project and every contractor, and "just Slack it" becomes your biggest unmanaged attack surface.
What good looks like
Secrets should live in one encrypted place, be pulled on demand, and be revocable in one click. The workflow is boring in the best way:
$ envsync login <token> # scope this repo $ envsync pull # get the team .env
A new teammate is productive in seconds — no chat archaeology, no copy-paste. When they leave, you remove them and their access is gone instantly.
…without trusting a server with your secrets
The catch with most secret managers is that they can read your secrets (stored server-side). EnvSync encrypts on your machine (AES-256-GCM) before anything syncs — the server only ever stores ciphertext. You replace the Slack mess and you don't hand your secrets to a vendor. See how →
The bottom line
"Just Slack it" was never a system — it was the absence of one. A managed, zero-knowledge vault with push/pull is the system, and it takes about two minutes to adopt.