> ## Documentation Index
> Fetch the complete documentation index at: https://envtrap.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Introduction
> envtrap v2.1 — Runtime security for Node.js. Block secret exfiltration before it leaves your process.
# What is envtrap?
**envtrap** is an open-source runtime security tool for **Node.js** applications. It wraps your process and intercepts every outbound channel in real time — before secrets, credentials, or sensitive environment variables can be exfiltrated by malicious code, compromised packages, or insider threats.
Unlike static analysis tools (SAST) that scan source code at build time, envtrap operates **at execution time** inside the Node.js runtime — inspecting actual traffic, child processes, DNS queries, and stdout/stderr output as they happen.
## The Problem
Modern Node.js applications are rich with sensitive data:
* `STRIPE_SECRET_KEY`, `DATABASE_URL`, `OPENAI_API_KEY` …
* Thousands of transitive npm dependencies with supply-chain risk
* No runtime visibility into *what* leaves your process
A single compromised package — even a deep transitive dependency — can silently exfiltrate your secrets. Traditional security tools won't catch this because:
| Tool | What it does | What it misses |
| ---------------- | ------------------------------ | --------------------------------- |
| SAST / linting | Scans source code for patterns | Runtime behavior, dynamic secrets |
| Secrets scanners | Finds secrets committed to git | Secrets only present at runtime |
| WAFs / Firewalls | Filters inbound traffic | Outbound, process-level egress |
| EDR / AV | Detects known malware | Legitimate runtime exfiltration |
## The Solution
envtrap solves this by wrapping your Node.js process with a **zero-instrumentation runtime guard** that:
* 🔒 Intercepts HTTPS / HTTP outbound requests via an in-memory MITM proxy
* 🔒 Monitors stdout / stderr for secret patterns and redacts them
* 🔒 Blocks unauthorized child processes and `execSync` calls
* 🔒 Detects DNS tunneling exfiltration attempts
* 🔒 Synchronizes dynamically-rotated runtime secrets in real time
* 🔒 Automatically bypasses local loopback traffic from the proxy
```bash theme={null}
# Before: vulnerable
node app.js
# After: protected
envtrap run node app.js
```
That's it. No code changes. No SDK to install. No agent to manage.
## Key Features
Drop envtrap in front of any `node` command. Works with Express, NestJS, Next.js, Fastify, and bare scripts.
Native OpenSSL RSA — certificates generated in \~5ms. Loopback traffic bypassed automatically via `NO_PROXY`.
Shannon entropy analysis catches high-entropy credential strings including dynamically-rotated secrets.
Detect and block DNS-based exfiltration via encoded subdomains, covering both callback and promise APIs.
`process.env` Proxy + `MessageChannel` broadcasts secret rotations to the ESM loader thread instantly.
Fine-tune `block` vs `warn` per channel via `envtrap.json`. Path exclusions and domain allowlists supported.
## What's New in v2.1.0
TLS certificate synthesis reduced from \~200ms to \~5ms using Node's `crypto.generateKeyPairSync` (C++ OpenSSL).
Eliminated O(n²) `Buffer.concat` in the MITM proxy — now uses a sliding-window overlap scanner.
All system CA tooling migrated from `execSync` template strings to safe `execFileSync` argument arrays.
Certificate serial numbers now use `crypto.randomBytes(20)` — no more `Date.now()` collision risk.
Runtime `process.env` mutations are broadcast to the ESM loader thread via `MessageChannel` immediately.
Loopback addresses and `exclusions.domains` are automatically added to `NO_PROXY`/`no_proxy`.
## Next Steps
Get envtrap running in under 60 seconds.
Deep dive into the runtime interception architecture.
Customize channels, exclusions, and policies.
Full reference for the `envtrap` CLI.