Developers often juggle cleartext `.env` files across projects, risking accidental commits. Rapg, an open-source tool written in Go, provides a terminal-first secret manager. It stores credentials in a secure local vault and injects them directly into running processes via the `rapg run` command, ensuring secrets exist only in memory and never touch the disk.

Built with a TUI using Bubble Tea, Rapg offers a keyboard-centric interface for searching, generating passwords, and auditing vaults for reuse. Its security model uses Argon2id for key derivation, AES-256-GCM for encryption, and memguard for memory protection. This addresses the gap between lightweight local development and heavy enterprise secret stores.

Rapg can import from CSV and export to `.env` for migration. As local development security becomes a bigger concern, tools like this offer a practical middle ground. The project is available on GitHub, inviting community feedback and contributions to its ongoing development.