KeyStack 1.2.0: .env files you can turn on and off from the menu bar

Every tool that reads a .env file has the same problem: the file has to exist on disk, and it usually stays there long after you've stopped working. KeyStack 1.2.0 is built around that gap. You activate a project from the macOS menu bar, KeyStack writes a real .env.local into the folder, and then it deletes that file for you when a timer runs out or your Mac sleeps.

If you haven't used KeyStack before, here's the short version. It's a native macOS app (Sonoma and later) that keeps environment variables and API keys in the system Keychain instead of in plaintext files. You organize them by project and environment, import existing .env files from a folder, export or diff them when you need to, and set rotation reminders per secret. There's no account, no network traffic, and no telemetry, and it's a one-time purchase on the Mac App Store. More detail lives at nerdsnipe.cc/keystack.

Activate a project from the menu bar

Before 1.2.0, getting secrets out of the vault meant opening the app and exporting. Now KeyStack lives in the menu bar with every project listed and an Activate button next to each. Click it and KeyStack writes the file into that project's folder, named .env.local by default or whatever filename you choose for that project.

It's a real file on purpose. Next.js dev servers, Docker Compose and Rails all read from disk, and none of them care that the source of truth is the Keychain. Deactivate and the file is gone.

KeyStack also remembers each project's export profile, meaning the environment you last used and the filename, so activating is one click after the first setup. If you want it even faster, there's an optional global keyboard shortcut that re-activates the project you used most recently. macOS treats that as Input Monitoring, so you'll need to grant permission in System Settings. KeyStack can't check whether you did, so if the shortcut does nothing, that's the first place to look.

Files that delete themselves

The obvious worry with any "write a secrets file" feature is forgetting it's there. So every activation has an expiry. You set a global timeout and can override it per project, and the menu bar dropdown shows a live countdown for each active project. About a minute before deletion, macOS sends a notification, so the file never vanishes mid-task without warning.

The file also goes away when things happen around it:

• your Mac sleeps, the display sleeps, or the screen locks
• you deactivate the project by hand
• you quit KeyStack, which now asks whether to deactivate first when something is still active (Cmd+Q, the Dock and the menu bar all trigger it)

Settings also has an activity log that records every activation and deactivation along with the reason. It answers the question of why your dev server lost its environment last week.

Two smaller additions help if you live in the menu bar: Launch at Login, and a Menu Bar Only mode that hides the Dock icon.

What changed under the hood

Most of the fixes in this release are about what happens when writing a plaintext secrets file goes wrong.

Export files are written with owner-only permissions (0600), and if KeyStack can't set those permissions, it deletes the file rather than leave it readable. Activating a project warns you before it overwrites an existing file, and export filenames are checked so they can't point outside the project folder.

The worst bug was this one: deleting a project while its export was active could orphan the plaintext file permanently, because the app lost track of where it had written it. KeyStack now removes the file first.

Smaller fixes include duplicate variable-to-project links (now blocked at the database level), multi-select "Add to Project" linking only the row you right-clicked instead of everything you selected, and the Export Settings window closing unexpectedly while you typed. It's now its own window rather than a popover. Toolbar icons are more consistent, the sidebar's two add actions are merged into one "+" menu, and "Open KeyStack" in the menu bar reliably reopens the main window even after you've closed it.

The tradeoff you're accepting

An activated project is a plaintext file, for as long as it exists. The timer, sleep detection and quit prompt shrink that window without removing it. And if KeyStack is force-quit, crashes, or your Mac loses power while a project is active, the file stays on disk until you next launch the app, at which point it's cleaned up automatically.

I think that's a fair trade for local development: your tools need the file, and this version removes it far sooner than a forgotten .env ever would. I'd keep timeouts short for anything touching production credentials, or leave those out of activation entirely. KeyStack also still isn't a team tool. It's single-user, macOS only, and it doesn't inject secrets into CI or servers. For that, use a cloud secrets manager like Doppler or Infisical.

KeyStack 1.2.0 is available now on the Mac App Store. If you already own it, update and try activating one project with a short timeout to see how the countdown feels. New here? Start at nerdsnipe.cc/keystack.