@dotenvx/dotenvx 2.28.1 → 2.28.2

package/CHANGELOG.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.28.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.28.2...main)
+
+## [2.28.2](https://github.com/dotenvx/dotenvx/compare/v2.28.1...v2.28.2) (2026-09-19)
+
+### Changed
+
+* Only owner can write to and read from .env.keys file ([#979](https://github.com/dotenvx/dotenvx/pull/979))
 
 ## [2.28.1](https://github.com/dotenvx/dotenvx/compare/v2.28.0...v2.28.1) (2026-09-19)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.28.1",
+  "version": "2.28.2",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/encrypt.js

@@ -54,7 +54,7 @@ async function encryptAction () {
     const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await encryptTransform({ envs, ik, ek, fk, noArmor, noCreate, noNative, no1Password, noBitwarden })
 
     if (keysSrc) {
-      await fsx.writeFileX(fk, keysSrc)
+      await fsx.writeKeyFile(fk, keysSrc)
     }
 
     if (spinner) spinner.stop()

package/src/cli/actions/set.js

@@ -70,7 +70,7 @@ async function set (key, value) {
     const { keysSrc, processedEnvs, changedFilepaths, unchangedFilepaths } = await setTransform({ envs, key, value, fk, noArmor, noCreate, encrypt, noNative, no1Password, noBitwarden })
 
     if (keysSrc) {
-      await fsx.writeFileX(fk, keysSrc)
+      await fsx.writeKeyFile(fk, keysSrc)
     }
 
     let withEncryption = ''

package/src/lib/helpers/fsx.js

@@ -2,6 +2,7 @@ const fs = require('fs')
 const Errors = require('./errors')
 
 const ENCODING = 'utf8'
+const KEY_FILE_OPTIONS = { encoding: ENCODING, mode: 0o600 }
 
 async function readFileX (filepath, encoding = null) {
   if (!encoding) {
@@ -19,9 +20,9 @@ function readFileXSync (filepath, encoding = null) {
   return fs.readFileSync(filepath, encoding) // utf8 default so it returns a string
 }
 
-function writeFileXSync (filepath, str) {
+function writeFileXSync (filepath, str, options = ENCODING) {
   try {
-    return fs.writeFileSync(filepath, str, ENCODING) // utf8 always
+    return fs.writeFileSync(filepath, str, options)
   } catch (error) {
     if (error.code === 'EACCES' || error.code === 'EPERM') {
       throw new Errors({ filepath }).fileNotWritable()
@@ -31,9 +32,9 @@ function writeFileXSync (filepath, str) {
   }
 }
 
-async function writeFileX (filepath, str) {
+async function writeFileX (filepath, str, options = ENCODING) {
   try {
-    return await fs.promises.writeFile(filepath, str, ENCODING)
+    return await fs.promises.writeFile(filepath, str, options)
   } catch (error) {
     if (error.code === 'EACCES' || error.code === 'EPERM') {
       throw new Errors({ filepath }).fileNotWritable()
@@ -43,6 +44,14 @@ async function writeFileX (filepath, str) {
   }
 }
 
+function writeKeyFile (filepath, str) {
+  return writeFileX(filepath, str, KEY_FILE_OPTIONS)
+}
+
+function writeKeyFileSync (filepath, str) {
+  return writeFileXSync(filepath, str, KEY_FILE_OPTIONS)
+}
+
 async function exists (filepath) {
   try {
     await fs.promises.access(filepath)
@@ -65,7 +74,9 @@ const fsx = {
   readFileX,
   readFileXSync,
   writeFileX,
-  writeFileXSync
+  writeFileXSync,
+  writeKeyFile,
+  writeKeyFileSync
 }
 
 module.exports = fsx

package/src/lib/helpers/removeEnvKey.js

@@ -1,5 +1,6 @@
 const fs = require('fs')
 const path = require('path')
+const fsx = require('./fsx')
 
 function escapeForRegex (value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
@@ -34,7 +35,7 @@ function removeEnvKey (key, keysFilepath = '.env.keys') {
 
     if (hasRemainingKeys) {
       const nextSrc = `${nextLines.join(eol)}${eol}`
-      fs.writeFileSync(resolvedKeysFilepath, nextSrc, 'utf8')
+      fsx.writeKeyFileSync(resolvedKeysFilepath, nextSrc)
     } else {
       fs.rmSync(resolvedKeysFilepath, { force: true })
     }

package/src/lib/helpers/upsertEnvKey.js

@@ -1,5 +1,6 @@
 const fs = require('fs')
 const path = require('path')
+const fsx = require('./fsx')
 
 function escapeForRegex (value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
@@ -46,7 +47,7 @@ function upsertEnvKey (key, value, keysFilepath = '.env.keys') {
   const changed = created || nextSrc !== src
 
   if (changed) {
-    fs.writeFileSync(resolvedKeysFilepath, nextSrc, 'utf8')
+    fsx.writeKeyFileSync(resolvedKeysFilepath, nextSrc)
   }
 
   return {

package/src/lib/main.js

@@ -266,7 +266,7 @@ const set = async function (key, value, options = {}) {
   })
 
   if (keysSrc) {
-    fsx.writeFileXSync(envKeysFilepath || '.env.keys', keysSrc)
+    fsx.writeKeyFileSync(envKeysFilepath || '.env.keys', keysSrc)
   }
 
   let withEncryption = ''