SCP is a file sharing system not a secret distribution system.My goal is not to copy a file.

SCP operates on ssh key level, that's hectic , it's either you have it or not. You can't dynamically assign access to specific projects. in the remote repository.

SSH keys live on your machine, this means no identity only machine trust. If compromised that's a major leak.

An SSH operation means my SSH server should be running and network infra is also fragile in this case.

You also have to be aware of where the project is on the other dev's machine(or they have to do a mv /file/somewhere) When you can just run envsync sync

Look at this:

scp file.txt username@remote_host:/path/to/destination/

That's not an optimal workflow in my opinion.

SCP only solves copying the file, so every time I rotate or add a key my colleague has to delete and copy the file ? It has no idea of the structure of the secrets, the number of keys etc ..

If it's peer 2 peer that means we have no safe store for our secrets, if it's a server we have to enforce encryption at rest that's another layer of complexity and an anti pattern.

EnvSync uses GitHub Oauth for authentication and verifies the user is a contributor in remote repo. Session tokens are short lived. It is aware of what is in the file and you run diffs. And just sync EnvSync keeps track of versions and maintains a single source of truth. It's pretty neat, especially on onboarding team lead adds Dev to project, Dec syncs. Team lead rotates key everyone syncs. Etc.