seal is a small CLI that replaces ad‑hoc .env files with secrets stored in OS‑native credential stores (macOS Keychain, libsecret on Linux, Windows Credential Manager) or external password managers (1Password, Bitwarden, or any backend reachable via a custom adapter). Secrets are injected at runtime as environment variables for the command you run, and are never persisted in plaintext on disk.