diff --git a/backend/src/app.ts b/backend/src/app.ts
index 608d5b828..aa7ac9b28 100644
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -42,6 +42,7 @@ import {
 } from './routes/v1';
 import {
   secret as v2SecretRouter,
+  secrets as v2SecretsRouter,
   workspace as v2WorkspaceRouter,
   serviceTokenData as v2ServiceTokenDataRouter,
   apiKeyData as v2APIKeyDataRouter,
@@ -95,16 +96,17 @@ app.use('/api/v1/membership', v1MembershipRouter);
 app.use('/api/v1/key', v1KeyRouter);
 app.use('/api/v1/invite-org', v1InviteOrgRouter);
 app.use('/api/v1/secret', v1SecretRouter);
-app.use('/api/v1/service-token', v1ServiceTokenRouter); // deprecate
+app.use('/api/v1/service-token', v1ServiceTokenRouter); // stop supporting
 app.use('/api/v1/password', v1PasswordRouter);
 app.use('/api/v1/stripe', v1StripeRouter);
 app.use('/api/v1/integration', v1IntegrationRouter);
 app.use('/api/v1/integration-auth', v1IntegrationAuthRouter);
 
 // v2 routes
-app.use('/api/v2/workspace', v2WorkspaceRouter);
-app.use('/api/v2/secret', v2SecretRouter);
-app.use('/api/v2/service-token', v2ServiceTokenDataRouter);
+app.use('/api/v2/workspace', v2WorkspaceRouter); // TODO: turn into plural route
+app.use('/api/v2/secret', v2SecretRouter); // stop supporting, TODO: revise
+app.use('/api/v2/secrets', v2SecretsRouter);
+app.use('/api/v2/service-token', v2ServiceTokenDataRouter); // TODO: turn into plural route
 app.use('/api/v2/api-key-data', v2APIKeyDataRouter);
 
 // api docs 
diff --git a/backend/src/controllers/v1/membershipOrgController.ts b/backend/src/controllers/v1/membershipOrgController.ts
index 5628cda1a..f3703b889 100644
--- a/backend/src/controllers/v1/membershipOrgController.ts
+++ b/backend/src/controllers/v1/membershipOrgController.ts
@@ -115,13 +115,14 @@ export const inviteUserToOrganization = async (req: Request, res: Response) => {
 		if (!membershipOrg) {
 			throw new Error('Failed to validate organization membership');
 		}
-
+		
 		invitee = await User.findOne({
 			email: inviteeEmail
-		});
+		}).select('+publicKey');
 
 		if (invitee) {
 			// case: invitee is an existing user
+			
 			inviteeMembershipOrg = await MembershipOrg.findOne({
 				user: invitee._id,
 				organization: organizationId
diff --git a/backend/src/controllers/v2/apiKeyDataController.ts b/backend/src/controllers/v2/apiKeyDataController.ts
index 3aacde8af..cafbacb5b 100644
--- a/backend/src/controllers/v2/apiKeyDataController.ts
+++ b/backend/src/controllers/v2/apiKeyDataController.ts
@@ -65,7 +65,6 @@ export const createAPIKeyData = async (req: Request, res: Response) => {
         apiKey = `ak.${apiKeyData._id.toString()}.${secret}`;
             
     } catch (err) {
-        console.error(err);
         Sentry.setUser({ email: req.user.email });
         Sentry.captureException(err);
         return res.status(400).send({
diff --git a/backend/src/controllers/v2/index.ts b/backend/src/controllers/v2/index.ts
index 2c5cce660..1651c09ee 100644
--- a/backend/src/controllers/v2/index.ts
+++ b/backend/src/controllers/v2/index.ts
@@ -2,10 +2,12 @@ import * as workspaceController from './workspaceController';
 import * as serviceTokenDataController from './serviceTokenDataController';
 import * as apiKeyDataController from './apiKeyDataController';
 import * as secretController from './secretController';
+import * as secretsController from './secretsController';
 
 export {
     workspaceController,
     serviceTokenDataController,
     apiKeyDataController,
-    secretController
+    secretController,
+    secretsController
 }
diff --git a/backend/src/controllers/v2/secretController.ts b/backend/src/controllers/v2/secretController.ts
index 3bb9f1720..b993d3811 100644
--- a/backend/src/controllers/v2/secretController.ts
+++ b/backend/src/controllers/v2/secretController.ts
@@ -7,12 +7,16 @@ const { ValidationError } = mongoose.Error;
 import { BadRequestError, InternalServerError, UnauthorizedRequestError, ValidationError as RouteValidationError } from '../../utils/errors';
 import { AnyBulkWriteOperation } from 'mongodb';
 import { SECRET_PERSONAL, SECRET_SHARED } from "../../variables";
-import { validateMembership } from "../../helpers/membership";
-import { ADMIN, MEMBER } from '../../variables';
+import { postHogClient } from '../../services';
 
-export const createSingleSecret = async (req: Request, res: Response) => {
+/**
+ * Create secret for workspace with id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
+ */
+export const createSecret = async (req: Request, res: Response) => {
   const secretToCreate: CreateSecretRequestBody = req.body.secret;
-  const { workspaceId, environmentName } = req.params
+  const { workspaceId, environment } = req.params
   const sanitizedSecret: SanitizedSecretForCreate = {
     secretKeyCiphertext: secretToCreate.secretKeyCiphertext,
     secretKeyIV: secretToCreate.secretKeyIV,
@@ -27,23 +31,44 @@ export const createSingleSecret = async (req: Request, res: Response) => {
     secretCommentTag: secretToCreate.secretCommentTag,
     secretCommentHash: secretToCreate.secretCommentHash,
     workspace: new Types.ObjectId(workspaceId),
-    environment: environmentName,
+    environment,
     type: secretToCreate.type,
     user: new Types.ObjectId(req.user._id)
   }
 
 
-  const [error, newlyCreatedSecret] = await to(Secret.create(sanitizedSecret).then())
+  const [error, secret] = await to(Secret.create(sanitizedSecret).then())
   if (error instanceof ValidationError) {
     throw RouteValidationError({ message: error.message, stack: error.stack })
   }
 
-  res.status(200).send()
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets added',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: 1,
+        workspaceId,
+        environment,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
+  } 
+
+  res.status(200).send({
+    secret
+  })
 }
 
-export const batchCreateSecrets = async (req: Request, res: Response) => {
+/**
+ * Create many secrets for workspace wiht id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
+ */
+export const createSecrets = async (req: Request, res: Response) => {
   const secretsToCreate: CreateSecretRequestBody[] = req.body.secrets;
-  const { workspaceId, environmentName } = req.params
+  const { workspaceId, environment } = req.params
   const sanitizedSecretesToCreate: SanitizedSecretForCreate[] = []
 
   secretsToCreate.forEach(rawSecret => {
@@ -61,7 +86,7 @@ export const batchCreateSecrets = async (req: Request, res: Response) => {
       secretCommentTag: rawSecret.secretCommentTag,
       secretCommentHash: rawSecret.secretCommentHash,
       workspace: new Types.ObjectId(workspaceId),
-      environment: environmentName,
+      environment,
       type: rawSecret.type,
       user: new Types.ObjectId(req.user._id)
     }
@@ -69,7 +94,7 @@ export const batchCreateSecrets = async (req: Request, res: Response) => {
     sanitizedSecretesToCreate.push(safeUpdateFields)
   })
 
-  const [bulkCreateError, newlyCreatedSecrets] = await to(Secret.insertMany(sanitizedSecretesToCreate).then())
+  const [bulkCreateError, secrets] = await to(Secret.insertMany(sanitizedSecretesToCreate).then())
   if (bulkCreateError) {
     if (bulkCreateError instanceof ValidationError) {
       throw RouteValidationError({ message: bulkCreateError.message, stack: bulkCreateError.stack })
@@ -78,10 +103,31 @@ export const batchCreateSecrets = async (req: Request, res: Response) => {
     throw InternalServerError({ message: "Unable to process your batch create request. Please try again", stack: bulkCreateError.stack })
   }
 
-  res.status(200).send()
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets added',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: (secretsToCreate ?? []).length,
+        workspaceId,
+        environment,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
+  }
+
+  res.status(200).send({
+    secrets
+  })
 }
 
-export const batchDeleteSecrets = async (req: Request, res: Response) => {
+/**
+ * Delete secrets in workspace with id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
+ */
+export const deleteSecrets = async (req: Request, res: Response) => {
   const { workspaceId, environmentName } = req.params
   const secretIdsToDelete: string[] = req.body.secretIds
 
@@ -93,10 +139,12 @@ export const batchDeleteSecrets = async (req: Request, res: Response) => {
   const secretsUserCanDeleteSet: Set<string> = new Set(secretIdsUserCanDelete.map(objectId => objectId._id.toString()));
   const deleteOperationsToPerform: AnyBulkWriteOperation<ISecret>[] = []
 
+  let numSecretsDeleted = 0;
   secretIdsToDelete.forEach(secretIdToDelete => {
     if (secretsUserCanDeleteSet.has(secretIdToDelete)) {
       const deleteOperation = { deleteOne: { filter: { _id: new Types.ObjectId(secretIdToDelete) } } }
       deleteOperationsToPerform.push(deleteOperation)
+      numSecretsDeleted++;
     } else {
       throw RouteValidationError({ message: "You cannot delete secrets that you do not have access to" })
     }
@@ -110,37 +158,57 @@ export const batchDeleteSecrets = async (req: Request, res: Response) => {
     throw InternalServerError()
   }
 
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets deleted',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: numSecretsDeleted,
+        environment: environmentName,
+        workspaceId,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
+  }
+
   res.status(200).send()
 }
 
-export const deleteSingleSecret = async (req: Request, res: Response) => {
-  const { secretId } = req.params;
+/**
+ * Delete secret with id [secretId]
+ * @param req 
+ * @param res
+ */
+export const deleteSecret = async (req: Request, res: Response) => {
+  await Secret.findByIdAndDelete(req._secret._id)
 
-  const [error, singleSecretRetrieved] = await to(Secret.findById(secretId).then())
-  if (error instanceof ValidationError) {
-    throw RouteValidationError({ message: "Unable to get secret, please try again", stack: error.stack })
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets deleted',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: 1,
+        workspaceId: req._secret.workspace.toString(),
+        environment: req._secret.environment,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
   }
 
-  if (singleSecretRetrieved) {
-    const [membershipValidationError, membership] = await to(validateMembership({
-      userId: req.user._id,
-      workspaceId: singleSecretRetrieved.workspace._id.toString(),
-      acceptedRoles: [ADMIN, MEMBER]
-    }))
-
-    if (membershipValidationError || !membership) {
-      throw UnauthorizedRequestError()
-    }
-
-    await Secret.findByIdAndDelete(secretId)
-
-    res.status(200).send()
-  } else {
-    throw BadRequestError()
-  }
+  res.status(200).send({
+    secret: req._secret
+  })
 }
 
-export const batchModifySecrets = async (req: Request, res: Response) => {
+/**
+ * Update secrets for workspace with id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const updateSecrets = async (req: Request, res: Response) => {
   const { workspaceId, environmentName } = req.params
   const secretsModificationsRequested: ModifySecretRequestBody[] = req.body.secrets;
   const [secretIdsUserCanModifyError, secretIdsUserCanModify] = await to(Secret.find({ workspace: workspaceId, environment: environmentName }, { _id: 1 }).then())
@@ -184,10 +252,30 @@ export const batchModifySecrets = async (req: Request, res: Response) => {
     throw InternalServerError()
   }
 
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets modified',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: (secretsModificationsRequested ?? []).length,
+        environment: environmentName,
+        workspaceId,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
+  }
+
   return res.status(200).send()
 }
 
-export const modifySingleSecrets = async (req: Request, res: Response) => {
+/**
+ * Update a secret within workspace with id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const updateSecret = async (req: Request, res: Response) => {
   const { workspaceId, environmentName } = req.params
   const secretModificationsRequested: ModifySecretRequestBody = req.body.secret;
 
@@ -216,14 +304,35 @@ export const modifySingleSecrets = async (req: Request, res: Response) => {
     throw RouteValidationError({ message: "Unable to apply modifications, please try again", stack: error.stack })
   }
 
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets modified',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: 1,
+        environment: environmentName,
+        workspaceId,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
+  }
+
   return res.status(200).send(singleModificationUpdate)
 }
 
-export const fetchAllSecrets = async (req: Request, res: Response) => {
+/**
+ * Return secrets for workspace with id [workspaceId], environment [environment] and user
+ * with id [req.user._id]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getSecrets = async (req: Request, res: Response) => {
   const { environment } = req.query;
   const { workspaceId } = req.params;
 
-  let userId: string | undefined = undefined // Used for choosing the personal secrets to fetch in 
+  let userId: string | undefined = undefined // used for getting personal secrets for user
   if (req.user) {
     userId = req.user._id.toString();
   }
@@ -232,7 +341,7 @@ export const fetchAllSecrets = async (req: Request, res: Response) => {
     userId = req.serviceTokenData.user._id
   }
 
-  const [retriveAllSecretsError, allSecrets] = await to(Secret.find(
+  const [err, secrets] = await to(Secret.find(
     {
       workspace: workspaceId,
       environment,
@@ -241,36 +350,49 @@ export const fetchAllSecrets = async (req: Request, res: Response) => {
     }
   ).then())
 
-  if (retriveAllSecretsError instanceof ValidationError) {
-    throw RouteValidationError({ message: "Unable to get secrets, please try again", stack: retriveAllSecretsError.stack })
+  if (err) {
+    throw RouteValidationError({ message: "Failed to get secrets, please try again", stack: err.stack })
   }
 
-  return res.json(allSecrets)
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets pulled',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: (secrets ?? []).length,
+        environment,
+        workspaceId,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
+  }
+
+  return res.json(secrets)
 }
 
-export const fetchSingleSecret = async (req: Request, res: Response) => {
-  const { secretId } = req.params;
-
-  const [error, singleSecretRetrieved] = await to(Secret.findById(secretId).then())
-
-  if (error instanceof ValidationError) {
-    throw RouteValidationError({ message: "Unable to get secret, please try again", stack: error.stack })
-  }
-
-  if (singleSecretRetrieved) {
-    const [membershipValidationError, membership] = await to(validateMembership({
-      userId: req.user._id,
-      workspaceId: singleSecretRetrieved.workspace._id.toString(),
-      acceptedRoles: [ADMIN, MEMBER]
-    }))
-
-    if (membershipValidationError || !membership) {
-      throw UnauthorizedRequestError()
-    }
-
-    res.json(singleSecretRetrieved)
-
-  } else {
-    throw BadRequestError()
+/**
+ * Return secret with id [secretId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getSecret = async (req: Request, res: Response) => {
+  if (postHogClient) {
+    postHogClient.capture({
+      event: 'secrets pulled',
+      distinctId: req.user.email,
+      properties: {
+        numberOfSecrets: 1,
+        workspaceId: req._secret.workspace.toString(),
+        environment: req._secret.environment,
+        channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+        userAgent: req.headers?.['user-agent']
+      }
+    });
   }
+  
+  return res.status(200).send({
+    secret: req._secret
+  });
 }
\ No newline at end of file
diff --git a/backend/src/controllers/v2/secretsController.ts b/backend/src/controllers/v2/secretsController.ts
new file mode 100644
index 000000000..69cacd75c
--- /dev/null
+++ b/backend/src/controllers/v2/secretsController.ts
@@ -0,0 +1,451 @@
+import to from 'await-to-js';
+import { Types } from 'mongoose';
+import { Request, Response } from 'express';
+import { ISecret, Secret } from '../../models';
+import { 
+    SECRET_PERSONAL, 
+    SECRET_SHARED,
+    ACTION_ADD_SECRETS,
+    ACTION_READ_SECRETS,
+    ACTION_UPDATE_SECRETS,
+    ACTION_DELETE_SECRETS
+} from '../../variables';
+import { ValidationError } from '../../utils/errors';
+import { EESecretService, EELogService } from '../../ee/services';
+import { postHogClient } from '../../services';
+import { BadRequestError } from '../../utils/errors';
+
+/**
+ * Create secret(s) for workspace with id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
+ */
+export const createSecrets = async (req: Request, res: Response) => {
+    const channel = req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli'; 
+    const { workspaceId, environment } = req.body;
+    
+    let toAdd;
+    if (Array.isArray(req.body.secrets)) {
+        // case: create multiple secrets
+        toAdd = req.body.secrets;
+    } else if (typeof req.body.secrets === 'object') {
+        // case: create 1 secret
+        toAdd = [req.body.secrets];
+    }
+    
+    const newSecrets = await Secret.insertMany(
+        toAdd.map(({
+            type,
+            secretKeyCiphertext,
+            secretKeyIV,
+            secretKeyTag,
+            secretValueCiphertext,
+            secretValueIV,
+            secretValueTag,
+        }: {
+            type: string;
+            secretKeyCiphertext: string;
+            secretKeyIV: string;
+            secretKeyTag: string;
+            secretValueCiphertext: string;
+            secretValueIV: string;
+            secretValueTag: string;
+        }) => ({
+            version: 1,
+            workspace: new Types.ObjectId(workspaceId),
+            type,
+            user: type === SECRET_PERSONAL ? req.user : undefined,
+            environment,
+            secretKeyCiphertext,
+            secretKeyIV,
+            secretKeyTag,
+            secretValueCiphertext,
+            secretValueIV,
+            secretValueTag
+        }))
+    );
+    
+    // (EE) add secret versions for new secrets
+    EESecretService.addSecretVersions({
+        secretVersions: newSecrets.map(({
+            _id,
+            version,
+            workspace,
+            type,
+            user,
+            environment,
+            secretKeyCiphertext,
+            secretKeyIV,
+            secretKeyTag,
+            secretKeyHash,
+            secretValueCiphertext,
+            secretValueIV,
+            secretValueTag,
+            secretValueHash
+        }) => ({
+            _id: new Types.ObjectId(),
+            secret: _id,
+            version,
+            workspace,
+            type,
+            user,
+            environment,
+            isDeleted: false,
+            secretKeyCiphertext,
+            secretKeyIV,
+            secretKeyTag,
+            secretKeyHash,
+            secretValueCiphertext,
+            secretValueIV,
+            secretValueTag,
+            secretValueHash
+        }))
+    });
+
+    const addAction = await EELogService.createActionSecret({
+        name: ACTION_ADD_SECRETS,
+        userId: req.user._id.toString(),
+        workspaceId,
+        secretIds: newSecrets.map((n) => n._id)
+    });
+
+    // (EE) create (audit) log
+    addAction && await EELogService.createLog({
+        userId: req.user._id.toString(),
+        workspaceId,
+        actions: [addAction],
+        channel,
+        ipAddress: req.ip
+    });
+
+    // (EE) take a secret snapshot
+    await EESecretService.takeSecretSnapshot({
+        workspaceId
+    });
+
+    if (postHogClient) {
+        postHogClient.capture({
+            event: 'secrets added',
+            distinctId: req.user.email,
+            properties: {
+                numberOfSecrets: toAdd.length,
+                environment,
+                workspaceId,
+                channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+                userAgent: req.headers?.['user-agent']
+            }
+        });
+    }
+
+    return res.status(200).send({
+        secrets: newSecrets
+    });
+}
+
+/**
+ * Return secret(s) for workspace with id [workspaceId], environment [environment] and user
+ * with id [req.user._id]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const getSecrets = async (req: Request, res: Response) => {
+    const { workspaceId, environment } = req.query;
+    
+    let userId: Types.ObjectId | undefined = undefined // used for getting personal secrets for user
+    if (req.user) {
+        userId = req.user._id;
+    }
+
+    if (req.serviceTokenData) {
+        userId = req.serviceTokenData.user._id
+    }
+    
+    const [err, secrets] = await to(Secret.find(
+        {
+            workspace: workspaceId,
+            environment,
+            $or: [
+                { user: userId }, 
+                { user: { $exists: false } }
+            ],
+            type: { $in: [SECRET_SHARED, SECRET_PERSONAL] }
+        }
+    ).then())
+
+    if (err) throw ValidationError({ message: 'Failed to get secrets', stack: err.stack });
+    
+    const channel = req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli';
+    
+    const readAction = await EELogService.createActionSecret({
+        name: ACTION_READ_SECRETS,
+        userId: req.user._id.toString(),
+        workspaceId: workspaceId as string,
+        secretIds: secrets.map((n: any) => n._id)
+    });
+
+    readAction && await EELogService.createLog({
+        userId: req.user._id.toString(),
+        workspaceId: workspaceId as string,
+        actions: [readAction],
+        channel,
+        ipAddress: req.ip
+    });
+
+    if (postHogClient) {
+        postHogClient.capture({
+            event: 'secrets deleted',
+            distinctId: req.user.email,
+            properties: {
+                numberOfSecrets: secrets.length,
+                environment,
+                workspaceId,
+                channel,
+                userAgent: req.headers?.['user-agent']
+            }
+        });
+    }
+    
+    return res.status(200).send({
+        secrets
+    });
+}
+
+/**
+ * Update secret(s)
+ * @param req 
+ * @param res 
+ */
+export const updateSecrets = async (req: Request, res: Response) => {
+    const channel = req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli'; 
+    
+    // TODO: move type
+    interface PatchSecret {
+        id: string;
+        secretKeyCiphertext: string;
+        secretKeyIV: string;
+        secretKeyTag: string;
+        secretValueCiphertext: string;
+        secretValueIV: string;
+        secretValueTag: string;
+        secretCommentCiphertext: string;
+        secretCommentIV: string;
+        secretCommentTag: string;
+    }
+
+    const ops = req.body.secrets.map((secret: PatchSecret) => {
+        const {
+            secretKeyCiphertext,
+            secretKeyIV,
+            secretKeyTag,
+            secretValueCiphertext,
+            secretValueIV,
+            secretValueTag,
+            secretCommentCiphertext,
+            secretCommentIV,
+            secretCommentTag
+        } = secret;
+        return ({
+            updateOne: {
+                filter: { _id: new Types.ObjectId(secret.id) },
+                update: {
+                    $inc: {
+                        version: 1
+                    },
+                    secretKeyCiphertext,
+                    secretKeyIV,
+                    secretKeyTag,
+                    secretValueCiphertext,
+                    secretValueIV,
+                    secretValueTag,
+                    ...((
+                        secretCommentCiphertext && 
+                        secretCommentIV && 
+                        secretCommentTag
+                    ) ? {
+                        secretCommentCiphertext,
+                        secretCommentIV,
+                        secretCommentTag
+                    } : {}),
+                }
+            }
+        });
+    });
+    await Secret.bulkWrite(ops);
+    
+    const newSecretsObj: { [key: string]: PatchSecret } = {};
+    req.body.secrets.forEach((secret: PatchSecret) => {
+        newSecretsObj[secret.id] = secret;
+    });
+
+    await EESecretService.addSecretVersions({
+        secretVersions: req.secrets.map((secret: ISecret) => {
+            const {
+                secretKeyCiphertext,
+                secretKeyIV,
+                secretKeyTag,
+                secretValueCiphertext,
+                secretValueIV,
+                secretValueTag,
+                secretCommentCiphertext,
+                secretCommentIV,
+                secretCommentTag 
+            } = newSecretsObj[secret._id.toString()]
+            return ({
+                secret: secret._id,
+                version: secret.version + 1,
+                workspace: secret.workspace,
+                type: secret.type,
+                environment: secret.environment,
+                isDeleted: false,
+                secretKeyCiphertext,
+                secretKeyIV,
+                secretKeyTag,
+                secretValueCiphertext,
+                secretValueIV,
+                secretValueTag,
+                ...((
+                    secretCommentCiphertext && 
+                    secretCommentIV && 
+                    secretCommentTag
+                ) ? {
+                    secretCommentCiphertext,
+                    secretCommentIV,
+                    secretCommentTag
+                } : {
+                    secretCommentCiphertext: '',
+                    secretCommentIV: '',
+                    secretCommentTag: ''
+                })
+            });
+        })
+    });
+
+    // group secrets into workspaces so updated secrets can
+    // be logged and snapshotted separately for each workspace
+    const workspaceSecretObj: any = {};
+    req.secrets.forEach((s: any) => {
+        if (s.workspace.toString() in workspaceSecretObj) {
+            workspaceSecretObj[s.workspace.toString()].push(s);
+        } else {
+            workspaceSecretObj[s.workspace.toString()] = [s]
+        }
+    });
+
+    Object.keys(workspaceSecretObj).forEach(async (key) => {
+        const updateAction = await EELogService.createActionSecret({
+            name: ACTION_UPDATE_SECRETS,
+            userId: req.user._id.toString(),
+            workspaceId: key,
+            secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
+        }); 
+
+        // (EE) create (audit) log
+        updateAction && await EELogService.createLog({
+            userId: req.user._id.toString(),
+            workspaceId: key,
+            actions: [updateAction],
+            channel,
+            ipAddress: req.ip
+        });
+
+        // (EE) take a secret snapshot
+		await EESecretService.takeSecretSnapshot({
+			workspaceId: key
+		})
+
+        if (postHogClient) {
+            postHogClient.capture({
+                event: 'secrets modified',
+                distinctId: req.user.email,
+                properties: {
+                    numberOfSecrets: workspaceSecretObj[key].length,
+                    environment: workspaceSecretObj[key][0].environment,
+                    workspaceId: key,
+                    channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+                    userAgent: req.headers?.['user-agent']
+                }
+            });
+        }
+    });
+    
+    return res.status(200).send({
+        secrets: await Secret.find({
+            _id: {
+                $in: req.secrets.map((secret: ISecret) => secret._id)
+            }
+        })
+    });
+}
+
+/**
+ * Delete secret(s) with id [workspaceId] and environment [environment]
+ * @param req 
+ * @param res 
+ */
+export const deleteSecrets = async (req: Request, res: Response) => {
+    const channel = req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli'; 
+    const toDelete = req.secrets.map((s: any) => s._id);
+    
+    await Secret.deleteMany({
+        _id: {
+            $in: toDelete
+        }
+    });
+    
+    await EESecretService.markDeletedSecretVersions({
+        secretIds: toDelete
+    });
+
+    // group secrets into workspaces so deleted secrets can
+    // be logged and snapshotted separately for each workspace
+    const workspaceSecretObj: any = {};
+    req.secrets.forEach((s: any) => {
+        if (s.workspace.toString() in workspaceSecretObj) {
+            workspaceSecretObj[s.workspace.toString()].push(s);
+        } else {
+            workspaceSecretObj[s.workspace.toString()] = [s]
+        }
+    });
+
+    Object.keys(workspaceSecretObj).forEach(async (key) => {
+        const deleteAction = await EELogService.createActionSecret({
+            name: ACTION_DELETE_SECRETS,
+            userId: req.user._id.toString(),
+            workspaceId: key,
+            secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
+        }); 
+
+        // (EE) create (audit) log
+        deleteAction && await EELogService.createLog({
+            userId: req.user._id.toString(),
+            workspaceId: key,
+            actions: [deleteAction],
+            channel,
+            ipAddress: req.ip
+        });
+
+        // (EE) take a secret snapshot
+		await EESecretService.takeSecretSnapshot({
+			workspaceId: key
+		})
+
+        if (postHogClient) {
+            postHogClient.capture({
+                event: 'secrets deleted',
+                distinctId: req.user.email,
+                properties: {
+                    numberOfSecrets: workspaceSecretObj[key].length,
+                    environment: workspaceSecretObj[key][0].environment,
+                    workspaceId: key,
+                    channel: req.headers?.['user-agent']?.toLowerCase().includes('mozilla') ? 'web' : 'cli',
+                    userAgent: req.headers?.['user-agent']
+                }
+            });
+        }
+    });
+    
+    return res.status(200).send({
+        secrets: req.secrets
+    });
+}
\ No newline at end of file
diff --git a/backend/src/ee/controllers/v1/secretController.ts b/backend/src/ee/controllers/v1/secretController.ts
index a2d68ca96..751f21611 100644
--- a/backend/src/ee/controllers/v1/secretController.ts
+++ b/backend/src/ee/controllers/v1/secretController.ts
@@ -1,6 +1,8 @@
 import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
+import { Secret } from '../../../models';
 import { SecretVersion } from '../../models';
+import { EESecretService } from '../../services';
 
 /**
  * Return secret versions for secret with id [secretId]
@@ -33,4 +35,103 @@ import { SecretVersion } from '../../models';
 	return res.status(200).send({
 		secretVersions
 	});
+}
+
+/**
+ * Roll back secret with id [secretId] to version [version]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const rollbackSecretVersion = async (req: Request, res: Response) => {
+	let secret;
+	try {
+		const { secretId } = req.params;
+		const { version } = req.body;
+		
+		// validate secret version
+		const oldSecretVersion = await SecretVersion.findOne({
+			secret: secretId,
+			version
+		});
+		
+		if (!oldSecretVersion) throw new Error('Failed to find secret version');
+		
+		const {
+			workspace,
+			type,
+			user,
+			environment,
+			secretKeyCiphertext,
+			secretKeyIV,
+			secretKeyTag,
+			secretKeyHash,
+			secretValueCiphertext,
+			secretValueIV,
+			secretValueTag,
+			secretValueHash
+		} = oldSecretVersion;
+		
+		// update secret
+		secret = await Secret.findByIdAndUpdate(
+			secretId,
+			{
+				$inc: {
+					version: 1
+				},
+				workspace,
+				type,
+				user,
+				environment,
+				secretKeyCiphertext,
+				secretKeyIV,
+				secretKeyTag,
+				secretKeyHash,
+				secretValueCiphertext,
+				secretValueIV,
+				secretValueTag,
+				secretValueHash
+			},
+			{
+				new: true
+			}
+		);
+		
+		if (!secret) throw new Error('Failed to find and update secret');
+
+		// add new secret version
+		await new SecretVersion({
+			secret: secretId,
+			version: secret.version,
+			workspace,
+			type,
+			user,
+			environment,
+			isDeleted: false,
+			secretKeyCiphertext,
+			secretKeyIV,
+			secretKeyTag,
+			secretKeyHash,
+			secretValueCiphertext,
+			secretValueIV,
+			secretValueTag,
+			secretValueHash	
+		}).save();
+		
+		// take secret snapshot
+		await EESecretService.takeSecretSnapshot({
+			workspaceId: secret.workspace.toString()
+		});
+		
+	} catch (err) {
+		Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to roll back secret version'
+		});
+	}
+	
+	return res.status(200).send({
+		secret
+	});
 }
\ No newline at end of file
diff --git a/backend/src/ee/controllers/v1/secretSnapshotController.ts b/backend/src/ee/controllers/v1/secretSnapshotController.ts
index 40e1a74a6..6e8605c2f 100644
--- a/backend/src/ee/controllers/v1/secretSnapshotController.ts
+++ b/backend/src/ee/controllers/v1/secretSnapshotController.ts
@@ -2,6 +2,12 @@ import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
 import { SecretSnapshot } from '../../models';
 
+/**
+ * Return secret snapshot with id [secretSnapshotId]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
 export const getSecretSnapshot = async (req: Request, res: Response) => {
     let secretSnapshot;
     try {
diff --git a/backend/src/ee/controllers/v1/workspaceController.ts b/backend/src/ee/controllers/v1/workspaceController.ts
index 88c31b8e1..8fd7c8746 100644
--- a/backend/src/ee/controllers/v1/workspaceController.ts
+++ b/backend/src/ee/controllers/v1/workspaceController.ts
@@ -1,9 +1,17 @@
-import e, { Request, Response } from 'express';
+import { Request, Response } from 'express';
 import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
+import {
+	Secret
+} from '../../../models';
 import { 
 	SecretSnapshot,
-	Log
+	Log,
+	SecretVersion,
+	ISecretVersion
 } from '../../models';
+import { EESecretService } from '../../services';
+import { getLatestSecretVersionIds } from '../../helpers/secretVersion';
 
 /**
  * Return secret snapshots for workspace with id [workspaceId]
@@ -63,6 +71,159 @@ export const getWorkspaceSecretSnapshotsCount = async (req: Request, res: Respon
 	});
 }
 
+/**
+ * Rollback secret snapshot with id [secretSnapshotId] to version [version]
+ * @param req 
+ * @param res 
+ * @returns 
+ */
+export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Response) => {
+	let secrets;
+    try {	
+        const { workspaceId } = req.params;
+        const { version } = req.body;
+        
+		// validate secret snapshot
+        const secretSnapshot = await SecretSnapshot.findOne({
+        	workspace: workspaceId,
+            version
+        }).populate<{ secretVersions: ISecretVersion[]}>('secretVersions');
+        
+        if (!secretSnapshot) throw new Error('Failed to find secret snapshot');
+
+		// TODO: fix any
+		const oldSecretVersionsObj: any = secretSnapshot.secretVersions
+			.reduce((accumulator, s) => ({ 
+				...accumulator, 
+				[`${s.secret.toString()}`]: s 
+			}), {});	
+		
+		const latestSecretVersionIds = await getLatestSecretVersionIds({
+			secretIds: secretSnapshot.secretVersions.map((sv) => sv.secret)
+		});
+		
+		// TODO: fix any
+		const latestSecretVersions: any = (await SecretVersion.find({
+			_id: {
+				$in: latestSecretVersionIds.map((s) => s.versionId)
+			}
+		}, 'secret version'))
+		.reduce((accumulator, s) => ({ 
+			...accumulator, 
+			[`${s.secret.toString()}`]: s 
+		}), {});
+		
+		// delete existing secrets
+		await Secret.deleteMany({
+			workspace: workspaceId
+		});
+
+		// add secrets
+        secrets = await Secret.insertMany(
+			secretSnapshot.secretVersions.map((sv) => {
+				const secretId = sv.secret;
+				const {
+					workspace,
+					type,
+					user,
+					environment,
+					secretKeyCiphertext,
+					secretKeyIV,
+					secretKeyTag,
+					secretKeyHash,
+					secretValueCiphertext,
+					secretValueIV,
+					secretValueTag,
+					secretValueHash,
+					createdAt
+				} = oldSecretVersionsObj[secretId.toString()];
+				
+				return ({
+					_id: secretId,
+					version: latestSecretVersions[secretId.toString()].version + 1,
+					workspace,
+					type,
+					user,
+					environment,
+					secretKeyCiphertext,
+					secretKeyIV,
+					secretKeyTag,
+					secretKeyHash,
+					secretValueCiphertext,
+					secretValueIV,
+					secretValueTag,
+					secretValueHash,
+					secretCommentCiphertext: '',
+					secretCommentIV: '',
+					secretCommentTag: '',
+					createdAt
+				});
+			})
+		);
+		
+		// add secret versions
+		await SecretVersion.insertMany(
+			secrets.map(({
+				_id,
+				version,
+				workspace,
+				type,
+				user,
+				environment,
+				secretKeyCiphertext,
+				secretKeyIV,
+				secretKeyTag,
+				secretKeyHash,
+				secretValueCiphertext,
+				secretValueIV,
+				secretValueTag,
+				secretValueHash
+			}) => ({
+				_id: new Types.ObjectId(),
+				secret: _id,
+				version,
+				workspace,
+				type,
+				user,
+				environment,
+				isDeleted: false,
+				secretKeyCiphertext,
+				secretKeyIV,
+				secretKeyTag,
+				secretKeyHash,
+				secretValueCiphertext,
+				secretValueIV,
+				secretValueTag,
+				secretValueHash
+			}))
+		);
+		
+		// update secret versions of restored secrets as not deleted
+		await SecretVersion.updateMany({
+			secret: {
+				$in: secretSnapshot.secretVersions.map((sv) => sv.secret)
+			}
+		}, {
+			isDeleted: false
+		});
+		
+        // take secret snapshot
+		await EESecretService.takeSecretSnapshot({
+			workspaceId
+		});
+    } catch (err) {
+        Sentry.setUser({ email: req.user.email });
+		Sentry.captureException(err);
+		return res.status(400).send({
+			message: 'Failed to roll back secret snapshot'
+		}); 
+    }
+    
+	return res.status(200).send({
+		secrets
+	});
+}
+
 /**
  * Return (audit) logs for workspace with id [workspaceId]
  * @param req 
diff --git a/backend/src/ee/helpers/action.ts b/backend/src/ee/helpers/action.ts
index 2971e3f96..389cfedbf 100644
--- a/backend/src/ee/helpers/action.ts
+++ b/backend/src/ee/helpers/action.ts
@@ -1,7 +1,10 @@
 import * as Sentry from '@sentry/node';
 import { Types } from 'mongoose';
-import { Secret } from '../../models';
 import { SecretVersion, Action } from '../models';
+import { 
+    getLatestSecretVersionIds,
+    getLatestNSecretSecretVersionIds
+} from '../helpers/secretVersion';
 import { ACTION_UPDATE_SECRETS } from '../../variables';
 
 /**
@@ -30,65 +33,23 @@ const createActionSecretHelper = async ({
         if (name === ACTION_UPDATE_SECRETS) {
             // case: action is updating secrets
             // -> add old and new secret versions
-
-            // TODO: make query more efficient
-            latestSecretVersions = (await SecretVersion.aggregate([
-                    {
-                        $match: {
-                        secret: {
-                            $in: secretIds,
-                        },
-                        },
-                    },
-                    {
-                        $sort: { version: -1 },
-                    },
-                    {
-                        $group: {
-                        _id: "$secret",
-                        versions: { $push: "$$ROOT" },
-                        },
-                    },
-                    {
-                        $project: {
-                        _id: 0,
-                        secret: "$_id",
-                        versions: { $slice: ["$versions", 2] },
-                        },
-                    }
-                ]))
-                .map((s) => ({
-                    oldSecretVersion: s.versions[0]._id,
-                    newSecretVersion: s.versions[1]._id
-                }));
-
-
+            latestSecretVersions = (await getLatestNSecretSecretVersionIds({
+                secretIds,
+                n: 2
+            }))
+            .map((s) => ({
+                oldSecretVersion: s.versions[0]._id,
+                newSecretVersion: s.versions[1]._id
+            }));
         } else {
             // case: action is adding, deleting, or reading secrets
             // -> add new secret versions
-            latestSecretVersions = (await SecretVersion.aggregate([
-				{
-					$match: { 
-                        secret: { 
-                            $in: secretIds 
-                        } 
-                    }
-				},
-				{
-					$group: {
-						_id: '$secret',
-						version: { $max: '$version' },
-                        versionId: { $max: '$_id' } // secret version id
-					}
-				},
-				{
-					$sort: { version: -1 }
-				}
-				])
-				.exec())
-                .map((s) => ({
-                    newSecretVersion: s.versionId
-                }));
+            latestSecretVersions = (await getLatestSecretVersionIds({
+                secretIds
+            }))
+            .map((s) => ({
+                newSecretVersion: s.versionId
+            }));
         }
 
         action = await new Action({
diff --git a/backend/src/ee/helpers/secretVersion.ts b/backend/src/ee/helpers/secretVersion.ts
new file mode 100644
index 000000000..d5859e183
--- /dev/null
+++ b/backend/src/ee/helpers/secretVersion.ts
@@ -0,0 +1,110 @@
+import * as Sentry from '@sentry/node';
+import { Types } from 'mongoose';
+import { SecretVersion } from '../models';
+
+/**
+ * Return latest secret versions for secrets with ids [secretIds]
+ * @param {Object} obj
+ * @param {Object} obj.secretIds = ids of secrets to get latest versions for
+ * @returns 
+ */
+const getLatestSecretVersionIds = async ({
+    secretIds
+}: {
+    secretIds: Types.ObjectId[];
+}) => {
+    
+    interface LatestSecretVersionId {
+        _id: Types.ObjectId;
+        version: number;
+        versionId: Types.ObjectId;
+    }
+    
+    let latestSecretVersionIds: LatestSecretVersionId[];
+    try {
+        latestSecretVersionIds = (await SecretVersion.aggregate([
+            {
+                $match: { 
+                    secret: { 
+                        $in: secretIds 
+                    } 
+                }
+            },
+            {
+                $group: {
+                    _id: '$secret',
+                    version: { $max: '$version' },
+                    versionId: { $max: '$_id' } // id of latest secret version
+                }
+            },
+            {
+                $sort: { version: -1 }
+            }
+            ])
+            .exec());
+            
+    } catch (err) {
+        Sentry.setUser(null);
+		Sentry.captureException(err);
+        throw new Error('Failed to get latest secret versions');
+    }
+    
+    return latestSecretVersionIds;
+}
+
+/**
+ * Return latest [n] secret versions for secrets with ids [secretIds]
+ * @param {Object} obj
+ * @param {Object} obj.secretIds = ids of secrets to get latest versions for
+ * @param {Number} obj.n - number of latest secret versions to return for each secret
+ * @returns 
+ */
+const getLatestNSecretSecretVersionIds = async ({
+    secretIds,
+    n
+}: {
+    secretIds: Types.ObjectId[];
+    n: number;
+}) => {
+    
+    // TODO: optimize query
+    let latestNSecretVersions;
+    try {
+        latestNSecretVersions = (await SecretVersion.aggregate([
+            {
+                $match: {
+                secret: {
+                    $in: secretIds,
+                },
+                },
+            },
+            {
+                $sort: { version: -1 },
+            },
+            {
+                $group: {
+                _id: "$secret",
+                versions: { $push: "$$ROOT" },
+                },
+            },
+            {
+                $project: {
+                _id: 0,
+                secret: "$_id",
+                versions: { $slice: ["$versions", n] },
+                },
+            }
+        ]));
+    } catch (err) {
+        Sentry.setUser(null);
+		Sentry.captureException(err);
+        throw new Error('Failed to get latest n secret versions');
+    }
+    
+    return latestNSecretVersions;
+}
+
+export {
+    getLatestSecretVersionIds,
+    getLatestNSecretSecretVersionIds
+}
diff --git a/backend/src/ee/models/secretVersion.ts b/backend/src/ee/models/secretVersion.ts
index 0197c3a25..616d44fbd 100644
--- a/backend/src/ee/models/secretVersion.ts
+++ b/backend/src/ee/models/secretVersion.ts
@@ -8,17 +8,8 @@ import {
 	ENV_PROD
 } from '../../variables';
 
-/**
- * TODO: 
- * 1. Modify SecretVersion to also contain XX
- * - type
- * - user
- * - environment
- * 2. Modify SecretSnapshot to point to arrays of SecretVersion
- */
-
 export interface ISecretVersion {
-    _id?: Types.ObjectId;
+	_id: Types.ObjectId;
     secret: Types.ObjectId;
     version: number;
 	workspace: Types.ObjectId; // new
@@ -68,7 +59,7 @@ const secretVersionSchema = new Schema<ISecretVersion>(
 			enum: [ENV_DEV, ENV_TESTING, ENV_STAGING, ENV_PROD],
 			required: true
 		},
-        isDeleted: {
+        isDeleted: { // consider removing field
             type: Boolean,
             default: false,
             required: true
@@ -86,8 +77,7 @@ const secretVersionSchema = new Schema<ISecretVersion>(
 			required: true
 		},
 		secretKeyHash: {
-			type: String,
-			required: true
+			type: String
 		},
 		secretValueCiphertext: {
 			type: String,
@@ -102,8 +92,7 @@ const secretVersionSchema = new Schema<ISecretVersion>(
 			required: true
 		},
 		secretValueHash: {
-			type: String,
-			required: true
+			type: String
 		}
     },
     {
diff --git a/backend/src/ee/routes/v1/secret.ts b/backend/src/ee/routes/v1/secret.ts
index 43cc8bafc..ac3089e33 100644
--- a/backend/src/ee/routes/v1/secret.ts
+++ b/backend/src/ee/routes/v1/secret.ts
@@ -5,7 +5,7 @@ import {
 	requireSecretAuth,
     validateRequest
 } from '../../../middleware';
-import { query, param } from 'express-validator';
+import { query, param, body } from 'express-validator';
 import { secretController } from '../../controllers/v1';
 import { ADMIN, MEMBER } from '../../../variables';
 
@@ -24,4 +24,17 @@ router.get(
 	secretController.getSecretVersions
 );
 
+router.post(
+	'/:secretId/secret-versions/rollback',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireSecretAuth({
+		acceptedRoles: [ADMIN, MEMBER]
+	}),
+	param('secretId').exists().trim(),
+	body('version').exists().isInt(),
+	secretController.rollbackSecretVersion
+);
+
 export default router;
\ No newline at end of file
diff --git a/backend/src/ee/routes/v1/secretSnapshot.ts b/backend/src/ee/routes/v1/secretSnapshot.ts
index 80aa7d1ee..d10da4456 100644
--- a/backend/src/ee/routes/v1/secretSnapshot.ts
+++ b/backend/src/ee/routes/v1/secretSnapshot.ts
@@ -7,7 +7,7 @@ import {
     requireAuth,
     validateRequest
 } from '../../../middleware';
-import { param } from 'express-validator';
+import { param, body } from 'express-validator';
 import { ADMIN, MEMBER } from '../../../variables';
 import { secretSnapshotController } from '../../controllers/v1';
 
diff --git a/backend/src/ee/routes/v1/workspace.ts b/backend/src/ee/routes/v1/workspace.ts
index 4b2e839eb..c9da58261 100644
--- a/backend/src/ee/routes/v1/workspace.ts
+++ b/backend/src/ee/routes/v1/workspace.ts
@@ -5,7 +5,7 @@ import {
 	requireWorkspaceAuth,
 	validateRequest
 } from '../../../middleware';
-import { param, query } from 'express-validator';
+import { param, query, body } from 'express-validator';
 import { ADMIN, MEMBER } from '../../../variables';
 import { workspaceController } from '../../controllers/v1';
 
@@ -37,6 +37,20 @@ router.get(
 	workspaceController.getWorkspaceSecretSnapshotsCount
 );
 
+router.post(
+	'/:workspaceId/secret-snapshots/rollback',
+	requireAuth({
+		acceptedAuthModes: ['jwt']
+	}),
+	requireWorkspaceAuth({
+		acceptedRoles: [ADMIN, MEMBER]
+	}),
+	param('workspaceId').exists().trim(),
+	body('version').exists().isInt(),
+	validateRequest,
+	workspaceController.rollbackWorkspaceSecretSnapshot
+);
+
 router.get(
 	'/:workspaceId/logs',
 	requireAuth({
diff --git a/backend/src/helpers/bot.ts b/backend/src/helpers/bot.ts
index b3f276b53..7519ef18b 100644
--- a/backend/src/helpers/bot.ts
+++ b/backend/src/helpers/bot.ts
@@ -72,7 +72,7 @@ const getSecretsHelper = async ({
     try {
         const key = await getKey({ workspaceId });
         const secrets = await Secret.find({
-            workspaceId,
+            workspace: workspaceId,
             environment,
             type: SECRET_SHARED
         });
@@ -84,7 +84,7 @@ const getSecretsHelper = async ({
                 tag: secret.secretKeyTag,
                 key
             });
-            
+
             const secretValue = decryptSymmetric({
                 ciphertext: secret.secretValueCiphertext,
                 iv: secret.secretValueIV,
diff --git a/backend/src/helpers/secret.ts b/backend/src/helpers/secret.ts
index 920e8dc1d..59d72f469 100644
--- a/backend/src/helpers/secret.ts
+++ b/backend/src/helpers/secret.ts
@@ -3,6 +3,7 @@ import { Types } from 'mongoose';
 import {
 	Secret,
 	ISecret,
+	Membership
 } from '../models';
 import {
 	EESecretService,
@@ -20,6 +21,46 @@ import {
 	ACTION_READ_SECRETS
 } from '../variables';
 
+/**
+ * Validate that user with id [userId] can modify secrets with ids [secretIds]
+ * @param {Object} obj
+ * @param {Object} obj.userId - id of user to validate
+ * @param {Object} obj.secretIds - secret ids
+ * @returns {Secret[]} secrets
+ */
+const validateSecrets = async ({
+	userId,
+	secretIds
+}: {
+	userId: string;
+	secretIds: string[];
+}) =>{
+	let secrets;
+	try {
+		secrets = await Secret.find({
+			_id: {
+				$in: secretIds
+			}
+		});
+		
+		const workspaceIdsSet = new Set((await Membership.find({
+			user: userId
+		}, 'workspace'))
+		.map((m) => m.workspace.toString()));
+		
+		secrets.forEach((secret: ISecret) => {
+			if (!workspaceIdsSet.has(secret.workspace.toString())) {
+				throw new Error('Failed to validate secret');
+			}
+		});
+		
+	} catch (err) {
+		throw new Error('Failed to validate secrets');
+	}
+
+	return secrets;
+}
+
 interface V1PushSecret {
 	ciphertextKey: string;
 	ivKey: string;
@@ -187,6 +228,7 @@ const v1PushSecrets = async ({
 			}) => {
 				const newSecret = newSecretsObj[`${type}-${secretKeyHash}`];
 				return ({
+					_id: new Types.ObjectId(),
 					secret: _id,
 					version: version ? version + 1 : 1,
 					workspace: new Types.ObjectId(workspaceId),
@@ -258,6 +300,7 @@ const v1PushSecrets = async ({
 					secretValueTag,
 					secretValueHash
 				}) => ({
+					_id: new Types.ObjectId(),
 					secret: _id,
 					version,
 					workspace,
@@ -280,7 +323,7 @@ const v1PushSecrets = async ({
 		// (EE) take a secret snapshot
 		await EESecretService.takeSecretSnapshot({
 			workspaceId
-		})
+		});
 	} catch (err) {
 		Sentry.setUser(null);
 		Sentry.captureException(err);
@@ -527,6 +570,7 @@ const v1PushSecrets = async ({
 	environment: string;
 }): Promise<ISecret[]> => {
 	let secrets: any; // TODO: FIX any
+	
 	try {
 		// get shared workspace secrets
 		const sharedSecrets = await Secret.find({
@@ -655,6 +699,7 @@ const reformatPullSecrets = ({ secrets }: { secrets: ISecret[] }) => {
 };
 
 export {
+	validateSecrets,
 	v1PushSecrets,
 	v2PushSecrets,
 	pullSecrets,
diff --git a/backend/src/middleware/index.ts b/backend/src/middleware/index.ts
index 119a86abe..6a3537076 100644
--- a/backend/src/middleware/index.ts
+++ b/backend/src/middleware/index.ts
@@ -8,6 +8,7 @@ import requireIntegrationAuthorizationAuth from './requireIntegrationAuthorizati
 import requireServiceTokenAuth from './requireServiceTokenAuth';
 import requireServiceTokenDataAuth from './requireServiceTokenDataAuth';
 import requireSecretAuth from './requireSecretAuth';
+import requireSecretsAuth from './requireSecretsAuth';
 import validateRequest from './validateRequest';
 
 export {
@@ -21,5 +22,6 @@ export {
 	requireServiceTokenAuth,
 	requireServiceTokenDataAuth,
 	requireSecretAuth,
+	requireSecretsAuth,
 	validateRequest
 };
diff --git a/backend/src/middleware/requireSecretAuth.ts b/backend/src/middleware/requireSecretAuth.ts
index c6a291200..36e47247e 100644
--- a/backend/src/middleware/requireSecretAuth.ts
+++ b/backend/src/middleware/requireSecretAuth.ts
@@ -5,6 +5,9 @@ import {
     validateMembership
 } from '../helpers/membership';
 
+// note: used for old /v1/secret and /v2/secret routes.
+// newer /v2/secrets routes use [requireSecretsAuth] middleware
+
 /**
  * Validate if user on request has proper membership to modify secret.
  * @param {Object} obj
@@ -34,7 +37,7 @@ const requireSecretAuth = ({
                 acceptedRoles
             });
             
-            req.secret = secret as any;
+            req._secret = secret;
 
             next();
         } catch (err) {
diff --git a/backend/src/middleware/requireSecretsAuth.ts b/backend/src/middleware/requireSecretsAuth.ts
new file mode 100644
index 000000000..c8b89a74c
--- /dev/null
+++ b/backend/src/middleware/requireSecretsAuth.ts
@@ -0,0 +1,49 @@
+import { Request, Response, NextFunction } from 'express';
+import { UnauthorizedRequestError } from '../utils/errors';
+import { Secret, Membership } from '../models';
+import { validateSecrets } from '../helpers/secret';
+
+// TODO: make this work for delete route
+
+const requireSecretsAuth = ({
+    acceptedRoles
+}: {
+    acceptedRoles: string[];
+}) => {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        let secrets;
+        try {
+            if (Array.isArray(req.body.secrets)) {
+                // case: validate multiple secrets
+                secrets = await validateSecrets({
+                    userId: req.user._id.toString(),
+                    secretIds: req.body.secrets.map((s: any) => s.id)
+                });
+            } else if (typeof req.body.secrets === 'object') { // change this to check for object
+                // case: validate 1 secret
+                secrets = await validateSecrets({
+                    userId: req.user._id.toString(),
+                    secretIds: req.body.secrets.id
+                });
+            } else if (Array.isArray(req.body.secretIds)) {
+                secrets = await validateSecrets({
+                    userId: req.user._id.toString(),
+                    secretIds: req.body.secretIds
+                });
+            } else if (typeof req.body.secretIds === 'string') {
+                // case: validate secretIds
+                secrets = await validateSecrets({
+                    userId: req.user._id.toString(),
+                    secretIds: [req.body.secretIds]
+                });
+            }
+            
+            req.secrets = secrets;
+            return next();
+        } catch (err) {
+            return next(UnauthorizedRequestError({ message: 'Unable to authenticate secret(s)' }));
+        }
+    }
+}
+
+export default requireSecretsAuth;
\ No newline at end of file
diff --git a/backend/src/models/secret.ts b/backend/src/models/secret.ts
index bbaaff8c3..a01b92d80 100644
--- a/backend/src/models/secret.ts
+++ b/backend/src/models/secret.ts
@@ -69,8 +69,7 @@ const secretSchema = new Schema<ISecret>(
 			required: true
 		},
 		secretKeyHash: {
-			type: String,
-			required: true
+			type: String
 		},
 		secretValueCiphertext: {
 			type: String,
@@ -85,8 +84,7 @@ const secretSchema = new Schema<ISecret>(
 			required: true
 		},
 		secretValueHash: {
-			type: String,
-			required: true
+			type: String
 		},
 		secretCommentCiphertext: {
 			type: String,
diff --git a/backend/src/routes/v2/index.ts b/backend/src/routes/v2/index.ts
index d0f3833ba..8bea42620 100644
--- a/backend/src/routes/v2/index.ts
+++ b/backend/src/routes/v2/index.ts
@@ -1,10 +1,12 @@
-import secret from './secret';
+import secret from './secret'; // stop-supporting
+import secrets from './secrets';
 import workspace from './workspace';
 import serviceTokenData from './serviceTokenData';
 import apiKeyData from './apiKeyData';
 
 export {
     secret,
+    secrets,
     workspace,
     serviceTokenData,
     apiKeyData
diff --git a/backend/src/routes/v2/secret.ts b/backend/src/routes/v2/secret.ts
index 893af8683..b0c0f8f36 100644
--- a/backend/src/routes/v2/secret.ts
+++ b/backend/src/routes/v2/secret.ts
@@ -1,18 +1,21 @@
-import express, { Request, Response } from 'express';
-import { requireAuth, requireWorkspaceAuth, validateRequest } from '../../middleware';
+import express from 'express';
+import { 
+  requireAuth, 
+  requireWorkspaceAuth,
+  requireSecretAuth,
+  validateRequest 
+} from '../../middleware';
 import { body, param, query } from 'express-validator';
 import { ADMIN, MEMBER } from '../../variables';
 import { CreateSecretRequestBody, ModifySecretRequestBody } from '../../types/secret';
 import { secretController } from '../../controllers/v2';
-import { fetchAllSecrets, fetchSingleSecret } from '../../controllers/v2/secretController';
+
+// note to devs: stop supporting
 
 const router = express.Router();
 
-/**
- * Create many secrets for a given workspace and environmentName
- */
 router.post(
-  '/batch-create/workspace/:workspaceId/environment/:environmentName',
+  '/batch-create/workspace/:workspaceId/environment/:environment',
   requireAuth({
     acceptedAuthModes: ['jwt']
   }),
@@ -20,17 +23,15 @@ router.post(
     acceptedRoles: [ADMIN, MEMBER]
   }),
   param('workspaceId').exists().isMongoId().trim(),
-  param('environmentName').exists().trim(),
+  param('environment').exists().trim(),
   body('secrets').exists().isArray().custom((value) => value.every((item: CreateSecretRequestBody) => typeof item === 'object')),
+  body('channel'),
   validateRequest,
-  secretController.batchCreateSecrets
+  secretController.createSecrets
 );
 
-/**
- * Create single secret for a given workspace and environmentName
- */
 router.post(
-  '/workspace/:workspaceId/environment/:environmentName',
+  '/workspace/:workspaceId/environment/:environment',
   requireAuth({
     acceptedAuthModes: ['jwt']
   }),
@@ -38,15 +39,13 @@ router.post(
     acceptedRoles: [ADMIN, MEMBER]
   }),
   param('workspaceId').exists().isMongoId().trim(),
-  param('environmentName').exists().trim(),
+  param('environment').exists().trim(),
   body('secret').exists().isObject(),
+  body('channel'),
   validateRequest,
-  secretController.createSingleSecret
+  secretController.createSecret
 );
 
-/**
- * Get all secrets for a given environment and workspace id
- */
 router.get(
   '/workspace/:workspaceId',
   param('workspaceId').exists().trim(),
@@ -57,25 +56,23 @@ router.get(
   requireWorkspaceAuth({
     acceptedRoles: [ADMIN, MEMBER]
   }),
+  query('channel'),
   validateRequest,
-  fetchAllSecrets
+  secretController.getSecrets
 );
 
-/**
- * Get single secret by id
- */
 router.get(
   '/:secretId',
   requireAuth({
     acceptedAuthModes: ['jwt', 'serviceToken']
   }),
+  requireSecretAuth({
+    acceptedRoles: [ADMIN, MEMBER]
+  }),
   validateRequest,
-  fetchSingleSecret
+  secretController.getSecret
 );
 
-/**
- * Batch delete secrets in a given workspace and environment name
- */
 router.delete(
   '/batch/workspace/:workspaceId/environment/:environmentName',
   requireAuth({
@@ -88,26 +85,22 @@ router.delete(
     acceptedRoles: [ADMIN, MEMBER]
   }),
   validateRequest,
-  secretController.batchDeleteSecrets
-
+  secretController.deleteSecrets
 );
 
-/**
- * delete single secret by id
- */
 router.delete(
   '/:secretId',
   requireAuth({
     acceptedAuthModes: ['jwt']
   }),
+  requireSecretAuth({
+    acceptedRoles: [ADMIN, MEMBER]
+  }),
   param('secretId').isMongoId(),
   validateRequest,
-  secretController.deleteSingleSecret
+  secretController.deleteSecret
 );
 
-/**
- * Apply modifications to many existing secrets in a given workspace and environment
- */
 router.patch(
   '/batch-modify/workspace/:workspaceId/environment/:environmentName',
   requireAuth({
@@ -120,12 +113,10 @@ router.patch(
     acceptedRoles: [ADMIN, MEMBER]
   }),
   validateRequest,
-  secretController.batchModifySecrets
+  secretController.updateSecrets
 );
 
-/**
- * Apply modifications to single existing secret in a given workspace and environment
- */
+
 router.patch(
   '/workspace/:workspaceId/environment/:environmentName',
   requireAuth({
@@ -138,7 +129,7 @@ router.patch(
     acceptedRoles: [ADMIN, MEMBER]
   }),
   validateRequest,
-  secretController.modifySingleSecrets
+  secretController.updateSecret
 );
 
 export default router;
diff --git a/backend/src/routes/v2/secrets.ts b/backend/src/routes/v2/secrets.ts
new file mode 100644
index 000000000..29eac042f
--- /dev/null
+++ b/backend/src/routes/v2/secrets.ts
@@ -0,0 +1,169 @@
+import express from 'express';
+const router = express.Router();
+import {
+    requireAuth,
+    requireWorkspaceAuth,
+    requireSecretsAuth,
+    validateRequest
+} from '../../middleware';
+import { query, check, body } from 'express-validator';
+import { secretsController } from '../../controllers/v2';
+import { 
+    ADMIN, 
+    MEMBER,
+    SECRET_PERSONAL,
+    SECRET_SHARED
+} from '../../variables';
+
+router.post(
+    '/',
+    body('workspaceId').exists().isString().trim(),
+    body('environment').exists().isString().trim().isIn(['dev', 'staging', 'prod', 'test']),
+    body('secrets')
+        .exists()
+        .custom((value) => {
+            if (Array.isArray(value)) {
+                // case: create multiple secrets
+                if (value.length === 0) throw new Error('secrets cannot be an empty array')
+                for (const secret of value) {
+                    if (
+                        !secret.type || 
+                        !(secret.type === SECRET_PERSONAL || secret.type === SECRET_SHARED) ||
+                        !secret.secretKeyCiphertext ||
+                        !secret.secretKeyIV ||
+                        !secret.secretKeyTag ||
+                        !secret.secretValueCiphertext ||
+                        !secret.secretValueIV ||
+                        !secret.secretValueTag
+                    ) {
+                        throw new Error('secrets array must contain objects that have required secret properties');
+                    }
+                }
+            } else if (typeof value === 'object') {
+                // case: update 1 secret
+                if (
+                    !value.type || 
+                    !(value.type === SECRET_PERSONAL || value.type === SECRET_SHARED) ||
+                    !value.secretKeyCiphertext ||
+                    !value.secretKeyIV ||
+                    !value.secretKeyTag ||
+                    !value.secretValueCiphertext ||
+                    !value.secretValueIV ||
+                    !value.secretValueTag
+                ) {
+                    throw new Error('secrets object is missing required secret properties');
+                } 
+            } else {
+                throw new Error('secrets must be an object or an array of objects')
+            }
+            
+            return true;
+    }),
+    validateRequest,
+    requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
+    requireWorkspaceAuth({
+        acceptedRoles: [ADMIN, MEMBER],
+        location: 'body'
+    }),
+    secretsController.createSecrets
+);
+
+router.get(
+    '/',
+    query('workspaceId').exists().trim(),
+    query('environment').exists().trim().isIn(['dev', 'staging', 'prod', 'test']),
+    validateRequest,
+    requireAuth({
+        acceptedAuthModes: ['jwt', 'serviceToken']
+    }),
+    requireWorkspaceAuth({
+        acceptedRoles: [ADMIN, MEMBER],
+        location: 'query'
+    }),
+    secretsController.getSecrets
+);
+
+router.patch(
+    '/',
+    body('secrets')
+        .exists()
+        .custom((value) => {
+            if (Array.isArray(value)) {
+                // case: update multiple secrets
+                if (value.length === 0) throw new Error('secrets cannot be an empty array')
+                for (const secret of value) {
+                    if (
+                        !secret.id || 
+                        !secret.secretKeyCiphertext ||
+                        !secret.secretKeyIV ||
+                        !secret.secretKeyTag ||
+                        !secret.secretValueCiphertext ||
+                        !secret.secretValueIV ||
+                        !secret.secretValueTag
+                    ) {
+                        throw new Error('secrets array must contain objects that have required secret properties');
+                    }
+                }
+            } else if (typeof value === 'object') {
+                // case: update 1 secret
+                if (
+                    !value.id || 
+                    !value.secretKeyCiphertext ||
+                    !value.secretKeyIV ||
+                    !value.secretKeyTag ||
+                    !value.secretValueCiphertext ||
+                    !value.secretValueIV ||
+                    !value.secretValueTag
+                ) {
+                    throw new Error('secrets object is missing required secret properties');
+                } 
+            } else {
+                throw new Error('secrets must be an object or an array of objects')
+            }
+            
+            return true;
+    }),
+    validateRequest,
+    requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
+    requireSecretsAuth({
+        acceptedRoles: [ADMIN, MEMBER]
+    }),
+    secretsController.updateSecrets
+);
+
+router.delete(
+    '/',
+    body('secretIds')
+        .exists()
+        .custom((value) => {
+            // case: delete 1 secret
+            if (typeof value === 'string') return true;
+            
+            if (Array.isArray(value)) {
+                // case: delete multiple secrets
+                if (value.length === 0) throw new Error('secrets cannot be an empty array');
+                return value.every((id: string) => typeof id === 'string')
+            }
+            
+            throw new Error('secretIds must be a string or an array of strings');
+        })
+        .not()
+        .isEmpty(),
+    validateRequest,
+    requireAuth({
+        acceptedAuthModes: ['jwt']
+    }),
+    requireSecretsAuth({
+        acceptedRoles: [ADMIN, MEMBER]
+    }),
+    secretsController.deleteSecrets
+);
+
+export default router;
+
+
+
diff --git a/backend/src/services/PostHogClient.ts b/backend/src/services/PostHogClient.ts
index 4ce0117f0..0d91a1c13 100644
--- a/backend/src/services/PostHogClient.ts
+++ b/backend/src/services/PostHogClient.ts
@@ -7,12 +7,12 @@ import {
 } from '../config';
 import { getLogger } from '../utils/logger';
 
-if(TELEMETRY_ENABLED){
+if(!TELEMETRY_ENABLED){
   getLogger("backend-main").info([
     "",
-    "Infisical collects telemetry data about general usage.",
-    "The data helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth for investors as we support Infisical as open-source software.",
-    "To opt out of telemetry, you can set `TELEMETRY_ENABLED=false` within the environment variables",
+    "To improve, Infisical collects telemetry data about general usage.",
+    "This helps us understand how the product is doing and guide our product development to create the best possible platform; it also helps us demonstrate growth as we support Infisical as open-source software.",
+    "To opt into telemetry, you can set `TELEMETRY_ENABLED=true` within the environment variables.",
   ].join('\n'))
 }
 
diff --git a/backend/src/types/express/index.d.ts b/backend/src/types/express/index.d.ts
index f43b5fa79..ae9edb4c5 100644
--- a/backend/src/types/express/index.d.ts
+++ b/backend/src/types/express/index.d.ts
@@ -1,4 +1,5 @@
 import * as express from 'express';
+import { ISecret } from '../../models';
 
 // TODO: fix (any) types
 declare global {
@@ -12,7 +13,8 @@ declare global {
 			integration: any;
 			integrationAuth: any;
 			bot: any;
-			secret: any;
+			_secret: any;
+			secrets: any;
 			secretSnapshot: any;
 			serviceToken: any;
 			accessToken: any;
diff --git a/backend/src/variables/integration.ts b/backend/src/variables/integration.ts
index ed18c5a2a..00e817c57 100644
--- a/backend/src/variables/integration.ts
+++ b/backend/src/variables/integration.ts
@@ -48,7 +48,7 @@ const INTEGRATION_OPTIONS = [
         name: 'Vercel',
         slug: 'vercel',
         image: 'Vercel', 
-        isAvailable: false,
+        isAvailable: true,
         type: 'vercel',
         clientId: '',
         clientSlug: CLIENT_SLUG_VERCEL,
@@ -58,7 +58,7 @@ const INTEGRATION_OPTIONS = [
         name: 'Netlify',
         slug: 'netlify',
         image: 'Netlify', 
-        isAvailable: false,
+        isAvailable: true,
         type: 'oauth2',
         clientId: CLIENT_ID_NETLIFY,
         docsLink: ''
@@ -67,7 +67,7 @@ const INTEGRATION_OPTIONS = [
         name: 'GitHub',
         slug: 'github',
         image: 'GitHub', 
-        isAvailable: false,
+        isAvailable: true,
         type: 'oauth2',
         clientId: CLIENT_ID_GITHUB,
         docsLink: ''
diff --git a/cli/packages/cmd/export.go b/cli/packages/cmd/export.go
index 96d8817b5..fd04e9ce2 100644
--- a/cli/packages/cmd/export.go
+++ b/cli/packages/cmd/export.go
@@ -31,8 +31,8 @@ var exportCmd = &cobra.Command{
 	Args:                  cobra.NoArgs,
 	PreRun: func(cmd *cobra.Command, args []string) {
 		toggleDebug(cmd, args)
-		util.RequireLogin()
-		util.RequireLocalWorkspaceFile()
+		// util.RequireLogin()
+		// util.RequireLocalWorkspaceFile()
 	},
 	Run: func(cmd *cobra.Command, args []string) {
 		envName, err := cmd.Flags().GetString("env")
diff --git a/cli/packages/cmd/login.go b/cli/packages/cmd/login.go
index 923782e3f..c10f38fc4 100644
--- a/cli/packages/cmd/login.go
+++ b/cli/packages/cmd/login.go
@@ -6,6 +6,7 @@ package cmd
 import (
 	"encoding/base64"
 	"encoding/hex"
+	"strings"
 
 	"errors"
 	"fmt"
@@ -17,6 +18,7 @@ import (
 	"github.com/Infisical/infisical-merge/packages/models"
 	"github.com/Infisical/infisical-merge/packages/srp"
 	"github.com/Infisical/infisical-merge/packages/util"
+	"github.com/fatih/color"
 	"github.com/go-resty/resty/v2"
 	"github.com/manifoldco/promptui"
 	log "github.com/sirupsen/logrus"
@@ -31,7 +33,9 @@ var loginCmd = &cobra.Command{
 	PreRun:                toggleDebug,
 	Run: func(cmd *cobra.Command, args []string) {
 		currentLoggedInUserDetails, err := util.GetCurrentLoggedInUserDetails()
-		if err != nil {
+		if err != nil && strings.Contains(err.Error(), "The specified item could not be found in the keyring") { // if the key can't be found allow them to override
+			log.Debug(err)
+		} else if err != nil {
 			util.HandleError(err)
 		}
 
@@ -97,7 +101,7 @@ var loginCmd = &cobra.Command{
 			util.HandleError(err, "Unable to write write to Infisical Config file. Please try again")
 		}
 
-		log.Infoln("Nice! You are loggin as:", email)
+		color.Green("Nice! You are logged in as: %v", email)
 
 	},
 }
diff --git a/cli/packages/cmd/run.go b/cli/packages/cmd/run.go
index 87b4cda4e..fe07dee82 100644
--- a/cli/packages/cmd/run.go
+++ b/cli/packages/cmd/run.go
@@ -12,8 +12,8 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/Infisical/infisical-merge/packages/models"
 	"github.com/Infisical/infisical-merge/packages/util"
+	"github.com/fatih/color"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
@@ -85,16 +85,50 @@ var runCmd = &cobra.Command{
 			secrets = util.OverrideWithPersonalSecrets(secrets)
 		}
 
+		secretsByKey := getSecretsByKeys(secrets)
+		environmentVariables := make(map[string]string)
+
+		// add all existing environment vars
+		for _, s := range os.Environ() {
+			kv := strings.SplitN(s, "=", 2)
+			key := kv[0]
+			value := kv[1]
+			environmentVariables[key] = value
+		}
+
+		// check to see if there are any reserved key words in secrets to inject
+		reservedEnvironmentVariables := []string{"HOME", "PATH", "PS1", "PS2"}
+		for _, reservedEnvName := range reservedEnvironmentVariables {
+			if _, ok := secretsByKey[reservedEnvName]; ok {
+				delete(secretsByKey, reservedEnvName)
+				util.PrintWarning(fmt.Sprintf("Infisical secret named [%v] has been removed because it is a reserved secret name", reservedEnvName))
+			}
+		}
+
+		// now add infisical secrets
+		for k, v := range secretsByKey {
+			environmentVariables[k] = v.Value
+		}
+
+		// turn it back into a list of envs
+		var env []string
+		for key, value := range environmentVariables {
+			s := key + "=" + value
+			env = append(env, s)
+		}
+
+		log.Debugf("injecting the following environment variables into shell: %v", env)
+
 		if cmd.Flags().Changed("command") {
 			command := cmd.Flag("command").Value.String()
 
-			err = executeMultipleCommandWithEnvs(command, secrets)
+			err = executeMultipleCommandWithEnvs(command, len(secretsByKey), env)
 			if err != nil {
 				util.HandleError(err, "Unable to execute your chained command")
 			}
 
 		} else {
-			err = executeSingleCommandWithEnvs(args, secrets)
+			err = executeSingleCommandWithEnvs(args, len(secretsByKey), env)
 			if err != nil {
 				util.HandleError(err, "Unable to execute your single command")
 			}
@@ -111,24 +145,21 @@ func init() {
 }
 
 // Will execute a single command and pass in the given secrets into the process
-func executeSingleCommandWithEnvs(args []string, secrets []models.SingleEnvironmentVariable) error {
+func executeSingleCommandWithEnvs(args []string, secretsCount int, env []string) error {
 	command := args[0]
 	argsForCommand := args[1:]
-	numberOfSecretsInjected := fmt.Sprintf("\u2713 Injected %v Infisical secrets into your application process successfully", len(secrets))
-	log.Infof("\x1b[%dm%s\x1b[0m", 32, numberOfSecretsInjected)
-	log.Debugf("executing command: %s %s \n", command, strings.Join(argsForCommand, " "))
-	log.Debugf("Secrets injected: %v", secrets)
+	color.Green("Injecting %v Infisical secrets into your application process", secretsCount)
 
 	cmd := exec.Command(command, argsForCommand...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
-	cmd.Env = getAllEnvs(secrets)
+	cmd.Env = env
 
 	return execCmd(cmd)
 }
 
-func executeMultipleCommandWithEnvs(fullCommand string, secrets []models.SingleEnvironmentVariable) error {
+func executeMultipleCommandWithEnvs(fullCommand string, secretsCount int, env []string) error {
 	shell := [2]string{"sh", "-c"}
 	if runtime.GOOS == "windows" {
 		shell = [2]string{"cmd", "/C"}
@@ -140,12 +171,10 @@ func executeMultipleCommandWithEnvs(fullCommand string, secrets []models.SingleE
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
-	cmd.Env = getAllEnvs(secrets)
+	cmd.Env = env
 
-	numberOfSecretsInjected := fmt.Sprintf("\u2713 Injected %v Infisical secrets into your application process successfully", len(secrets))
-	log.Infof("\x1b[%dm%s\x1b[0m", 32, numberOfSecretsInjected)
+	color.Green("Injecting %v Infisical secrets into your application process", secretsCount)
 	log.Debugf("executing command: %s %s %s \n", shell[0], shell[1], fullCommand)
-	log.Debugf("Secrets injected: %v", secrets)
 
 	return execCmd(cmd)
 }
@@ -175,23 +204,3 @@ func execCmd(cmd *exec.Cmd) error {
 	os.Exit(waitStatus.ExitStatus())
 	return nil
 }
-
-func getAllEnvs(envsToInject []models.SingleEnvironmentVariable) []string {
-	env_map := make(map[string]string)
-
-	for _, env := range os.Environ() {
-		splitEnv := strings.Split(env, "=")
-		env_map[splitEnv[0]] = splitEnv[1]
-	}
-
-	for _, env := range envsToInject {
-		env_map[env.Key] = env.Value // overrite any envs with ones to inject if they clash
-	}
-
-	var allEnvs []string
-	for key, value := range env_map {
-		allEnvs = append(allEnvs, fmt.Sprintf("%s=%s", key, value))
-	}
-
-	return allEnvs
-}
diff --git a/cli/packages/cmd/secrets.go b/cli/packages/cmd/secrets.go
index df77e67d4..5a9ce2724 100644
--- a/cli/packages/cmd/secrets.go
+++ b/cli/packages/cmd/secrets.go
@@ -311,14 +311,25 @@ var secretsDeleteCmd = &cobra.Command{
 
 func init() {
 	secretsCmd.AddCommand(secretsGetCmd)
-	secretsCmd.AddCommand(secretsSetCmd)
-	secretsCmd.AddCommand(secretsDeleteCmd)
-	secretsCmd.PersistentFlags().String("env", "dev", "Used to select the environment name on which actions should be taken on")
-	secretsCmd.Flags().Bool("expand", true, "Parse shell parameter expansions in your secrets")
-	secretsCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
+	secretsGetCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
 		util.RequireLogin()
 		util.RequireLocalWorkspaceFile()
 	}
+
+	secretsCmd.AddCommand(secretsSetCmd)
+	secretsSetCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
+		util.RequireLogin()
+		util.RequireLocalWorkspaceFile()
+	}
+
+	secretsCmd.AddCommand(secretsDeleteCmd)
+	secretsDeleteCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
+		util.RequireLogin()
+		util.RequireLocalWorkspaceFile()
+	}
+
+	secretsCmd.PersistentFlags().String("env", "dev", "Used to select the environment name on which actions should be taken on")
+	secretsCmd.Flags().Bool("expand", true, "Parse shell parameter expansions in your secrets")
 	rootCmd.AddCommand(secretsCmd)
 }
 
diff --git a/cli/packages/util/errors.go b/cli/packages/util/log.go
similarity index 88%
rename from cli/packages/util/errors.go
rename to cli/packages/util/log.go
index 1761d6f7b..a701987fc 100644
--- a/cli/packages/util/errors.go
+++ b/cli/packages/util/log.go
@@ -23,6 +23,10 @@ func PrintErrorAndExit(exitCode int, err error, messages ...string) {
 	os.Exit(exitCode)
 }
 
+func PrintWarning(message string) {
+	color.Yellow("Warning: %v", message)
+}
+
 func PrintMessageAndExit(messages ...string) {
 	if len(messages) > 0 {
 		for _, message := range messages {
diff --git a/cli/packages/util/secrets.go b/cli/packages/util/secrets.go
index 131a8e66d..c0a3ad952 100644
--- a/cli/packages/util/secrets.go
+++ b/cli/packages/util/secrets.go
@@ -117,9 +117,11 @@ func GetAllEnvironmentVariables(envName string) ([]models.SingleEnvironmentVaria
 		secrets, err := GetPlainTextSecretsViaJTW(loggedInUserDetails.UserCredentials.JTWToken, loggedInUserDetails.UserCredentials.PrivateKey, workspaceFile.WorkspaceId, envName)
 		return secrets, err
 
-	} else {
+	} else if infisicalToken != "" {
 		log.Debug("Trying to fetch secrets using service token")
 		return GetPlainTextSecretsViaServiceToken(infisicalToken)
+	} else {
+		return nil, fmt.Errorf("unable to fetch secrets because we could not find a service token or a logged in user")
 	}
 }
 
diff --git a/cli/packages/util/vault.go b/cli/packages/util/vault.go
index 5561f2aee..7e4ce1b31 100644
--- a/cli/packages/util/vault.go
+++ b/cli/packages/util/vault.go
@@ -33,6 +33,7 @@ func GetKeyRing() (keyring.Keyring, error) {
 		LibSecretCollectionName:        KEYRING_SERVICE_NAME,
 		KWalletAppID:                   KEYRING_SERVICE_NAME,
 		KWalletFolder:                  KEYRING_SERVICE_NAME,
+		KeychainName:                   "login", // default so user will not be prompted
 		KeychainTrustApplication:       true,
 		WinCredPrefix:                  KEYRING_SERVICE_NAME,
 		FileDir:                        fmt.Sprintf("~/%s-file-vault", KEYRING_SERVICE_NAME),
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 9b0838209..014d858c4 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -50,6 +50,7 @@ services:
       - ./frontend/public:/app/public
       - ./frontend/styles:/app/styles
       - ./frontend/components:/app/components
+      - ./frontend/ee:/app/ee
       - ./frontend/locales:/app/locales
       - ./frontend/next-i18next.config.js:/app/next-i18next.config.js
     env_file: .env
diff --git a/docs/getting-started/dashboard/audit-logs.mdx b/docs/getting-started/dashboard/audit-logs.mdx
index bb31423b4..808a7112d 100644
--- a/docs/getting-started/dashboard/audit-logs.mdx
+++ b/docs/getting-started/dashboard/audit-logs.mdx
@@ -2,8 +2,10 @@
 title: "Activity Logs"
 ---
 
-Activity logs record all actions going through Infisical including CRUD operations applied to environment variables. They help answer questions like:
+Activity logs record all actions going through Infisical including who performed which CRUD operations on environment variables and from what IP address. They help answer questions like:
 
 - Who added or updated environment variables recently?
 - Did Bob read environment variables last week (if at all)?
 - What IP address was used for that action?
+
+![Activity logs](../../images/activity-logs.png)
diff --git a/docs/getting-started/dashboard/pit-recovery.mdx b/docs/getting-started/dashboard/pit-recovery.mdx
index 534cc2718..8881f117f 100644
--- a/docs/getting-started/dashboard/pit-recovery.mdx
+++ b/docs/getting-started/dashboard/pit-recovery.mdx
@@ -2,4 +2,22 @@
 title: "Point-in-Time Recovery"
 ---
 
-Point-in-time (PIT) recovery allows environment variables to be rolled back to any point in time. It's powered by snapshots that get captured after mutations to environment variables.
+Point-in-time recovery allows environment variables to be rolled back to any point in time. It's powered by snapshots that get captured after mutations to environment variables.
+
+## Commits
+
+Similar to Git, a commit in Infisical is a snapshot of your project's secrets at a specific point in time. You can browse and view your project's snapshots via the "Point-in-Time Recovery" sidebar.
+
+![PIT commits](../../images/pit-commits.png)
+![PIT snapshots](../../images/pit-snapshots.png)
+
+## Rolling back
+
+Environment variables can be rolled back to any point in time via the "Rollback to this snapshot" button.
+
+![PIT snapshot](../../images/pit-snapshot.png)
+
+<Note>
+  Rolling back environment variables to a past snapshot creates a new commit and
+  snapshot at the top of the stack and updates secret versions.
+</Note>
diff --git a/docs/getting-started/dashboard/secret-versioning.mdx b/docs/getting-started/dashboard/secret-versioning.mdx
new file mode 100644
index 000000000..ccf94fef1
--- /dev/null
+++ b/docs/getting-started/dashboard/secret-versioning.mdx
@@ -0,0 +1,14 @@
+---
+title: "Secret Versioning"
+---
+
+Secret versioning records changes made to every secret.
+
+![secret versioning](../../images/secret-versioning.png)
+
+<Note>
+  You can copy and paste a secret version value to the "Value" input field "roll
+  back" to that secret version. This creates a new secret version at the top of
+  the stack. We're releasing the ability to press and automatically roll back to
+  a secret version soon.
+</Note>
diff --git a/docs/getting-started/dashboard/versioning.mdx b/docs/getting-started/dashboard/versioning.mdx
deleted file mode 100644
index 3a6ba2e2c..000000000
--- a/docs/getting-started/dashboard/versioning.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: "Secret Versioning"
----
-
-Secret versioning allows an individual environment variable to be rolled back without touching other project environment variables.
diff --git a/docs/images/activity-logs.png b/docs/images/activity-logs.png
new file mode 100644
index 000000000..29349c82b
Binary files /dev/null and b/docs/images/activity-logs.png differ
diff --git a/docs/images/pit-commits.png b/docs/images/pit-commits.png
new file mode 100644
index 000000000..19cfa4976
Binary files /dev/null and b/docs/images/pit-commits.png differ
diff --git a/docs/images/pit-snapshot.png b/docs/images/pit-snapshot.png
new file mode 100644
index 000000000..7e790e875
Binary files /dev/null and b/docs/images/pit-snapshot.png differ
diff --git a/docs/images/pit-snapshots.png b/docs/images/pit-snapshots.png
new file mode 100644
index 000000000..f22231648
Binary files /dev/null and b/docs/images/pit-snapshots.png differ
diff --git a/docs/images/secret-versioning.png b/docs/images/secret-versioning.png
new file mode 100644
index 000000000..ec1734289
Binary files /dev/null and b/docs/images/secret-versioning.png differ
diff --git a/docs/mint.json b/docs/mint.json
index d4146ff9b..4b83b5c17 100644
--- a/docs/mint.json
+++ b/docs/mint.json
@@ -39,11 +39,6 @@
       "icon": "server",
       "url": "self-hosting"
     },
-    {
-      "name": "API Reference",
-      "icon": "cloud",
-      "url": "self-hosting"
-    },
     {
       "name": "Integrations",
       "icon": "plug",
@@ -86,7 +81,7 @@
         "getting-started/dashboard/project",
         "getting-started/dashboard/integrations",
         "getting-started/dashboard/pit-recovery",
-        "getting-started/dashboard/versioning",
+        "getting-started/dashboard/secret-versioning",
         "getting-started/dashboard/audit-logs",
         "getting-started/dashboard/token"
       ]
diff --git a/frontend/components/basic/Layout.tsx b/frontend/components/basic/Layout.tsx
index ef8eda727..48399cdce 100644
--- a/frontend/components/basic/Layout.tsx
+++ b/frontend/components/basic/Layout.tsx
@@ -19,7 +19,7 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import getOrganizations from "~/pages/api/organization/getOrgs";
 import getOrganizationUserProjects from "~/pages/api/organization/GetOrgUserProjects";
 import getOrganizationUsers from "~/pages/api/organization/GetOrgUsers";
-import checkUserAction from "~/pages/api/userActions/checkUserAction";
+import getUser from "~/pages/api/user/getUser";
 import addUserToWorkspace from "~/pages/api/workspace/addUserToWorkspace";
 import createWorkspace from "~/pages/api/workspace/createWorkspace";
 import getWorkspaces from "~/pages/api/workspace/getWorkspaces";
@@ -39,6 +39,7 @@ import Listbox from "./Listbox";
 interface LayoutProps {
   children: React.ReactNode;
 }
+const crypto = require("crypto");
 
 export default function Layout({ children }: LayoutProps) {
   const router = useRouter();
@@ -83,12 +84,31 @@ export default function Layout({ children }: LayoutProps) {
         });
         const newWorkspaceId = newWorkspace._id;
 
+        const randomBytes = crypto.randomBytes(16).toString("hex");
+        const PRIVATE_KEY = String(localStorage.getItem("PRIVATE_KEY"));
+
+        const myUser = await getUser();
+
+        const { ciphertext, nonce } = encryptAssymmetric({
+          plaintext: randomBytes,
+          publicKey: myUser.publicKey,
+          privateKey: PRIVATE_KEY,
+        }) as { ciphertext: string; nonce: string };
+
+        await uploadKeys(
+          newWorkspaceId,
+          myUser._id,
+          ciphertext,
+          nonce
+        );
+
         if (addAllUsers) {
+          console.log('adding other users')
           const orgUsers = await getOrganizationUsers({
             orgId: tempLocalStorage("orgData.id"),
           });
           orgUsers.map(async (user: any) => {
-            if (user.status == "accepted") {
+            if (user.status == "accepted" && user.email != myUser.email) {
               const result = await addUserToWorkspace(
                 user.user.email,
                 newWorkspaceId
diff --git a/frontend/components/basic/Toggle.tsx b/frontend/components/basic/Toggle.tsx
index d15aed622..c9957cc3c 100644
--- a/frontend/components/basic/Toggle.tsx
+++ b/frontend/components/basic/Toggle.tsx
@@ -34,7 +34,7 @@ interface ToggleProps {
  * @param {string} obj.value - value of a certain secret
  * @param {number} obj.pos - position of a certain secret
  #TODO: make the secret id persistent?
- * @param {string} obj.id - id of a certain secret  
+ * @param {string} obj.id - id of a certain secret (NOTE: THIS IS THE ID OF THE MAIN SECRET - NOT OF AN OVERRIDE)
  * @param {function} obj.deleteOverride - a function that deleted an override for a certain secret
  * @param {string[]} obj.sharedToHide - an array of shared secrets that we want to hide visually because they are overriden. 
  * @param {function} obj.setSharedToHide - a function that updates the array of secrets that we want to hide visually
diff --git a/frontend/components/basic/popups/BottomRightPopup.tsx b/frontend/components/basic/popups/BottomRightPopup.tsx
index e6ea60f92..71b4f4a66 100644
--- a/frontend/components/basic/popups/BottomRightPopup.tsx
+++ b/frontend/components/basic/popups/BottomRightPopup.tsx
@@ -36,7 +36,7 @@ export default function BottonRightPopup({
 }: PopupProps): JSX.Element {
   return (
     <div
-      className="z-50 drop-shadow-xl border-gray-600/50 border flex flex-col items-start bg-bunker max-w-xl text-gray-200 pt-3 pb-4 rounded-xl absolute bottom-0 right-0 mr-6 mb-6"
+      className="z-50 drop-shadow-xl border-gray-600/50 border flex flex-col items-start bg-bunker max-w-xl text-gray-200 pt-3 pb-4 rounded-md absolute bottom-0 right-0 mr-6 mb-6"
       role="alert"
     >
       <div className="flex flex-row items-center justify-between w-full border-b border-gray-600/70 pb-3 px-6">
diff --git a/frontend/components/dashboard/CommentField.tsx b/frontend/components/dashboard/CommentField.tsx
index ea29aa73c..62ff0c2f1 100644
--- a/frontend/components/dashboard/CommentField.tsx
+++ b/frontend/components/dashboard/CommentField.tsx
@@ -6,10 +6,10 @@ import { useTranslation } from "next-i18next";
 const CommentField = ({ comment, modifyComment, position }: { comment: string; modifyComment: (value: string, posistion: number) => void; position: number;}) => {
   const { t } = useTranslation();
 
-  return <div className={`relative mt-4 px-4 pt-4`}>
-    <p className='text-sm text-bunker-300'>{t("dashboard:sidebar.comments")}</p>
+  return <div className={`relative mt-4 px-4 pt-6`}>
+    <p className='text-sm text-bunker-300 pl-0.5'>{t("dashboard:sidebar.comments")}</p>
     <textarea 
-      className="bg-bunker-800 h-32 w-full bg-bunker-800 p-2 rounded-md border border-mineshaft-500 text-sm text-bunker-300 outline-none focus:ring-2 ring-primary-800 ring-opacity-70"
+      className="bg-bunker-800 placeholder:text-bunker-400 h-32 w-full bg-bunker-800 px-2 py-1.5 rounded-md border border-mineshaft-500 text-sm text-bunker-300 outline-none focus:ring-2 ring-primary-800 ring-opacity-70"
       value={comment}
       onChange={(e) => modifyComment(e.target.value, position)}
       placeholder="Leave any comments here..."
diff --git a/frontend/components/dashboard/DownloadSecretsMenu.tsx b/frontend/components/dashboard/DownloadSecretsMenu.tsx
new file mode 100644
index 000000000..2d5e6f59b
--- /dev/null
+++ b/frontend/components/dashboard/DownloadSecretsMenu.tsx
@@ -0,0 +1,75 @@
+import { Fragment } from 'react';
+import { useTranslation } from "next-i18next";
+import { faDownload } from '@fortawesome/free-solid-svg-icons';
+import { Menu, Transition } from '@headlessui/react';
+
+import Button from '../basic/buttons/Button';
+import downloadDotEnv from '../utilities/secrets/downloadDotEnv';
+import downloadYaml from '../utilities/secrets/downloadYaml';
+
+
+interface SecretDataProps {
+  type: 'personal' | 'shared';
+  pos: number;
+  key: string;
+  value: string;
+  id: string;
+  comment: string;
+}
+
+/**
+ * This is the menu that is used to download secrets as .env ad .yml files (in future we may have more options)
+ * @param {object} obj 
+ * @param {SecretDataProps[]} obj.data - secrets that we want to downlaod
+ * @param {string} obj.env - the environment which we're downloading (used for naming the file)
+ */
+const DownloadSecretMenu = ({ data, env }: { data: SecretDataProps[]; env: string; }) => {
+  const { t } = useTranslation();
+
+  return <Menu
+    as="div"
+    className="relative inline-block text-left"
+  >
+    <Menu.Button
+      as="div"
+      className="inline-flex w-full justify-center text-sm font-medium text-gray-200 rounded-md hover:bg-white/10 duration-200 focus:outline-none focus-visible:ring-2 focus-visible:ring-white focus-visible:ring-opacity-75"
+    >
+      <Button
+        color="mineshaft"
+        size="icon-md"
+        icon={faDownload}
+        onButtonPressed={() => {}}
+      />
+    </Menu.Button>
+    <Transition
+      as={Fragment}
+      enter="transition ease-out duration-100"
+      enterFrom="transform opacity-0 scale-95"
+      enterTo="transform opacity-100 scale-100"
+      leave="transition ease-in duration-75"
+      leaveFrom="transform opacity-100 scale-100"
+      leaveTo="transform opacity-0 scale-95"
+    >
+      <Menu.Items className="absolute z-50 drop-shadow-xl right-0 mt-0.5 w-[12rem] origin-top-right rounded-md bg-bunker border border-mineshaft-500 shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none p-2 space-y-2">
+        <Menu.Item>
+          <Button
+            color="mineshaft"
+            onButtonPressed={() => downloadDotEnv({ data, env })}
+            size="md"
+            text="Download as .env"
+          />
+        </Menu.Item>
+        <Menu.Item>
+          <Button
+            color="mineshaft"
+            onButtonPressed={() => downloadYaml({ data, env })}
+            size="md"
+            text="Download as .yml"
+          />
+        </Menu.Item>
+      </Menu.Items>
+    </Transition>
+  </Menu>
+}
+
+export default DownloadSecretMenu;
diff --git a/frontend/components/dashboard/SideBar.tsx b/frontend/components/dashboard/SideBar.tsx
index 52107b512..33b936f52 100644
--- a/frontend/components/dashboard/SideBar.tsx
+++ b/frontend/components/dashboard/SideBar.tsx
@@ -163,7 +163,7 @@ const SideBar = ({
           </div>
         </div>
         <SecretVersionList secretId={data[0]?.id} />
-        <CommentField comment={data.filter(secret => secret.type == "shared")[0]?.comment} modifyComment={modifyComment} position={data[0]?.pos} />
+        <CommentField comment={data.filter(secret => secret.type == "shared")[0]?.comment} modifyComment={modifyComment} position={data.filter(secret => secret.type == "shared")[0]?.pos} />
       </div>
     )}
     <div className={`flex justify-start max-w-sm mt-4 px-4 mt-full mb-[4.7rem]`}>
diff --git a/frontend/components/integrations/Integration.tsx b/frontend/components/integrations/Integration.tsx
index ae9a1a613..11edf7cb7 100644
--- a/frontend/components/integrations/Integration.tsx
+++ b/frontend/components/integrations/Integration.tsx
@@ -23,6 +23,7 @@ import {
 interface Integration {
     _id: string;
     app?: string;
+    target?: string;
     environment: string;
     integration: string;
     integrationAuth: string;
@@ -69,7 +70,11 @@ const Integration = ({
         
         switch (integration.integration) {
           case "vercel":
-            setIntegrationTarget("Development");
+            setIntegrationTarget(
+              integration?.target 
+              ? integration.target.charAt(0).toUpperCase() + integration.target.substring(1) 
+              : "Development"
+            );
             break;
           case "netlify":
             setIntegrationContext(integration?.context ? contextNetlifyMapping[integration.context] : "Local development");
@@ -93,11 +98,11 @@ const Integration = ({
                 </div>
                 <ListBox
                   data={!integration.isActive ? [
-                    "Production",
+                    "Development",
                     "Preview",
-                    "Development"
+                    "Production"
                   ] : null}
-                  selected={"Production"}
+                  selected={integrationTarget}
                   onChange={setIntegrationTarget}
                 />
             </div>
diff --git a/frontend/components/navigation/NavBarDashboard.tsx b/frontend/components/navigation/NavBarDashboard.tsx
index b2752f3ed..c4e66a5c0 100644
--- a/frontend/components/navigation/NavBarDashboard.tsx
+++ b/frontend/components/navigation/NavBarDashboard.tsx
@@ -112,9 +112,9 @@ export default function Navbar() {
           href="https://infisical.com/docs/getting-started/introduction"
           target="_blank"
           rel="noopener noreferrer"
-          className="text-gray-200 hover:text-primary duration-200">
+          className="text-gray-200 hover:bg-white/10 px-3 rounded-md duration-200 text-sm mr-4 py-2 flex items-center">
+          <FontAwesomeIcon icon={faBook} className="text-xl mr-2" />
           Docs 
-          <FontAwesomeIcon icon={faUpRightFromSquare} className="text-xs mb-[0.1rem] mr-5 ml-1.5" />
         </a>
         <Menu as="div" className="relative inline-block text-left">
           <div className="mr-4">
diff --git a/frontend/components/utilities/attemptLogin.js b/frontend/components/utilities/attemptLogin.js
deleted file mode 100644
index db4725c0d..000000000
--- a/frontend/components/utilities/attemptLogin.js
+++ /dev/null
@@ -1,147 +0,0 @@
-import Aes256Gcm from '~/components/utilities/cryptography/aes-256-gcm';
-import login1 from '~/pages/api/auth/Login1';
-import login2 from '~/pages/api/auth/Login2';
-import getOrganizations from '~/pages/api/organization/getOrgs';
-import getOrganizationUserProjects from '~/pages/api/organization/GetOrgUserProjects';
-
-import pushKeys from './secrets/pushKeys';
-import Telemetry from './telemetry/Telemetry';
-import { saveTokenToLocalStorage } from './saveTokenToLocalStorage';
-import SecurityClient from './SecurityClient';
-
-const nacl = require('tweetnacl');
-nacl.util = require('tweetnacl-util');
-const jsrp = require('jsrp');
-const client = new jsrp.client();
-
-/**
- * This function loggs in the user (whether it's right after signup, or a normal login)
- * @param {*} email
- * @param {*} password
- * @param {*} setErrorLogin
- * @param {*} router
- * @param {*} isSignUp
- * @returns
- */
-const attemptLogin = async (
-  email,
-  password,
-  setErrorLogin,
-  router,
-  isSignUp,
-  isLogin
-) => {
-  try {
-    const telemetry = new Telemetry().getInstance();
-
-    client.init(
-      {
-        username: email,
-        password: password
-      },
-      async () => {
-        const clientPublicKey = client.getPublicKey();
-
-        try {
-          const { serverPublicKey, salt } = await login1(email, clientPublicKey);
-
-          client.setSalt(salt);
-          client.setServerPublicKey(serverPublicKey);
-          const clientProof = client.getProof(); // called M1
-
-          // if everything works, go the main dashboard page.
-          const { token, publicKey, encryptedPrivateKey, iv, tag } =
-            await login2(email, clientProof);
-          
-          SecurityClient.setToken(token);
-
-          const privateKey = Aes256Gcm.decrypt({
-            ciphertext: encryptedPrivateKey,
-            iv,
-            tag,
-            secret: password
-              .slice(0, 32)
-              .padStart(
-                32 + (password.slice(0, 32).length - new Blob([password]).size),
-                '0'
-              )
-          });
-
-          saveTokenToLocalStorage({
-            publicKey,
-            encryptedPrivateKey,
-            iv,
-            tag,
-            privateKey
-          });
-          
-          const userOrgs = await getOrganizations();
-          const userOrgsData = userOrgs.map((org) => org._id);
-
-          let orgToLogin;
-          if (userOrgsData.includes(localStorage.getItem('orgData.id'))) {
-            orgToLogin = localStorage.getItem('orgData.id');
-          } else {
-            orgToLogin = userOrgsData[0];
-            localStorage.setItem('orgData.id', orgToLogin);
-          }
-
-          let orgUserProjects = await getOrganizationUserProjects({
-            orgId: orgToLogin
-          });
-
-          orgUserProjects = orgUserProjects?.map((project) => project._id);
-          let projectToLogin;
-          if (
-            orgUserProjects.includes(localStorage.getItem('projectData.id'))
-          ) {
-            projectToLogin = localStorage.getItem('projectData.id');
-          } else {
-            try {
-              projectToLogin = orgUserProjects[0];
-              localStorage.setItem('projectData.id', projectToLogin);
-            } catch (error) {
-              console.log('ERROR: User likely has no projects. ', error);
-            }
-          }
-
-          // If user is logging in for the first time, add the example keys
-          if (isSignUp) {
-            await pushKeys({
-              obj: {
-                sDATABASE_URL: [
-                  'mongodb+srv://${DB_USERNAME}:${DB_PASSWORD}@mongodb.net',
-                  'This is an example of secret referencing.'
-                ],
-                sDB_USERNAME: ['OVERRIDE_THIS', ''],
-                sDB_PASSWORD: ['OVERRIDE_THIS', ''],
-                pDB_USERNAME: ['user1234', 'This is an example of secret overriding. Your team can have a shared value of a secret, while you can override it to whatever value you need.'],
-                pDB_PASSWORD: ['example_password', 'This is an example of secret overriding. Your team can have a shared value of a secret, while you can override it to whatever value you need.'],
-                sTWILIO_AUTH_TOKEN: ['example_twillio_token', ''],
-                sWEBSITE_URL: ['http://localhost:3000', ''],
-              },
-              workspaceId: projectToLogin,
-              env: 'Development'
-            });
-          }
-          if (email) {
-            telemetry.identify(email);
-            telemetry.capture('User Logged In');
-          }
-
-          if (isLogin) {
-            router.push('/dashboard/');
-          }
-        } catch (error) {
-          setErrorLogin(true);
-          console.log('Login response not available');
-        }
-      }
-    );
-  } catch (error) {
-    console.log('Something went wrong during authentication');
-  }
-  return true;
-};
-
-export default attemptLogin;
diff --git a/frontend/components/utilities/attemptLogin.ts b/frontend/components/utilities/attemptLogin.ts
new file mode 100644
index 000000000..c40dbb548
--- /dev/null
+++ b/frontend/components/utilities/attemptLogin.ts
@@ -0,0 +1,217 @@
+import Aes256Gcm from '~/components/utilities/cryptography/aes-256-gcm';
+import login1 from '~/pages/api/auth/Login1';
+import login2 from '~/pages/api/auth/Login2';
+import addSecrets from '~/pages/api/files/AddSecrets';
+import getOrganizations from '~/pages/api/organization/getOrgs';
+import getOrganizationUserProjects from '~/pages/api/organization/GetOrgUserProjects';
+import getUser from '~/pages/api/user/getUser';
+import uploadKeys from '~/pages/api/workspace/uploadKeys';
+
+import { encryptAssymmetric } from './cryptography/crypto';
+import encryptSecrets from './secrets/encryptSecrets';
+import Telemetry from './telemetry/Telemetry';
+import { saveTokenToLocalStorage } from './saveTokenToLocalStorage';
+import SecurityClient from './SecurityClient';
+
+interface SecretDataProps {
+  type: 'personal' | 'shared';
+  pos: number;
+  key: string;
+  value: string;
+  id: string;
+  comment: string;
+}
+
+const crypto = require("crypto");
+const nacl = require('tweetnacl');
+nacl.util = require('tweetnacl-util');
+const jsrp = require('jsrp');
+const client = new jsrp.client();
+
+/**
+ * This function logs in the user (whether it's right after signup, or a normal login)
+ * @param {string} email - email of the user logging in
+ * @param {string} password - password of the user logging in
+ * @param {function} setErrorLogin - function that visually dispay an error is something is wrong
+ * @param {*} router
+ * @param {boolean} isSignUp - whether this log in is a part of signup
+ * @param {boolean} isLogin - ?
+ * @returns
+ */
+const attemptLogin = async (
+  email: string,
+  password: string,
+  setErrorLogin: (value: boolean) => void,
+  router: any,
+  isSignUp: boolean,
+  isLogin: boolean
+) => {
+  try {
+    const telemetry = new Telemetry().getInstance();
+
+    client.init(
+      {
+        username: email,
+        password: password
+      },
+      async () => {
+        const clientPublicKey = client.getPublicKey();
+
+        try {
+          const { serverPublicKey, salt } = await login1(email, clientPublicKey);
+
+          client.setSalt(salt);
+          client.setServerPublicKey(serverPublicKey);
+          const clientProof = client.getProof(); // called M1
+
+          // if everything works, go the main dashboard page.
+          const { token, publicKey, encryptedPrivateKey, iv, tag } =
+            await login2(email, clientProof);
+          
+          SecurityClient.setToken(token);
+
+          const privateKey = Aes256Gcm.decrypt({
+            ciphertext: encryptedPrivateKey,
+            iv,
+            tag,
+            secret: password
+              .slice(0, 32)
+              .padStart(
+                32 + (password.slice(0, 32).length - new Blob([password]).size),
+                '0'
+              )
+          });
+
+          saveTokenToLocalStorage({
+            publicKey,
+            encryptedPrivateKey,
+            iv,
+            tag,
+            privateKey
+          });
+          
+          const userOrgs = await getOrganizations();
+          const userOrgsData = userOrgs.map((org: { _id: string; }) => org._id);
+
+          let orgToLogin;
+          if (userOrgsData.includes(localStorage.getItem('orgData.id'))) {
+            orgToLogin = localStorage.getItem('orgData.id');
+          } else {
+            orgToLogin = userOrgsData[0];
+            localStorage.setItem('orgData.id', orgToLogin);
+          }
+
+          let orgUserProjects = await getOrganizationUserProjects({
+            orgId: orgToLogin
+          });
+
+          orgUserProjects = orgUserProjects?.map((project: { _id: string; }) => project._id);
+          let projectToLogin;
+          if (
+            orgUserProjects.includes(localStorage.getItem('projectData.id'))
+          ) {
+            projectToLogin = localStorage.getItem('projectData.id');
+          } else {
+            try {
+              projectToLogin = orgUserProjects[0];
+              localStorage.setItem('projectData.id', projectToLogin);
+            } catch (error) {
+              console.log('ERROR: User likely has no projects. ', error);
+            }
+          }
+          
+          if (email) {
+            telemetry.identify(email);
+            telemetry.capture('User Logged In');
+          }
+
+          if (isSignUp) {
+            const randomBytes = crypto.randomBytes(16).toString("hex");
+            const PRIVATE_KEY = String(localStorage.getItem("PRIVATE_KEY"));
+
+            const myUser = await getUser();
+
+            const { ciphertext, nonce } = encryptAssymmetric({
+              plaintext: randomBytes,
+              publicKey: myUser.publicKey,
+              privateKey: PRIVATE_KEY,
+            }) as { ciphertext: string; nonce: string };
+
+            await uploadKeys(
+              projectToLogin,
+              myUser._id,
+              ciphertext,
+              nonce
+            );
+
+            const secretsToBeAdded: SecretDataProps[] = [{
+              type: "shared",
+              pos: 0,
+              key: "DATABASE_URL",
+              value: "mongodb+srv://${DB_USERNAME}:${DB_PASSWORD}@mongodb.net",
+              comment: "This is an example of secret referencing.",
+              id: ''
+            }, {
+              type: "shared",
+              pos: 1,
+              key: "DB_USERNAME",
+              value: "OVERRIDE_THIS",
+              comment: "This is an example of secret overriding. Your team can have a shared value of a secret, while you can override it to whatever value you need",
+              id: ''
+            }, {
+              type: "personal",
+              pos: 2,
+              key: "DB_USERNAME",
+              value: "user1234",
+              comment: "",
+              id: ''
+            }, {
+              type: "shared",
+              pos: 3,
+              key: "DB_PASSWORD",
+              value: "OVERRIDE_THIS",
+              comment: "This is an example of secret overriding. Your team can have a shared value of a secret, while you can override it to whatever value you need",
+              id: ''
+            }, {
+              type: "personal",
+              pos: 4,
+              key: "DB_PASSWORD",
+              value: "example_password",
+              comment: "",
+              id: ''
+            }, {
+              type: "shared",
+              pos: 5,
+              key: "TWILIO_AUTH_TOKEN",
+              value: "example_twillio_token",
+              comment: "This is an example of secret overriding. Your team can have a shared value of a secret, while you can override it to whatever value you need",
+              id: ''
+            }, {
+              type: "shared",
+              pos: 6,
+              key: "WEBSITE_URL",
+              value: "http://localhost:3000",
+              comment: "This is an example of secret overriding. Your team can have a shared value of a secret, while you can override it to whatever value you need",
+              id: ''
+            }]
+            const secrets = await encryptSecrets({ secretsToEncrypt: secretsToBeAdded, workspaceId: String(localStorage.getItem('projectData.id')), env: 'dev' })
+            await addSecrets({ secrets: secrets ?? [], env: "dev", workspaceId: String(localStorage.getItem('projectData.id')) });
+          }
+
+          if (isLogin) {
+            router.push('/dashboard/' + localStorage.getItem('projectData.id'));
+          }
+        } catch (error) {
+          console.log(error)
+          setErrorLogin(true);
+          console.log('Login response not available');
+        }
+      }
+    );
+  } catch (error) {
+    console.log('Something went wrong during authentication');
+  }
+  return true;
+};
+
+export default attemptLogin;
diff --git a/frontend/components/utilities/secrets/checkOverrides.ts b/frontend/components/utilities/secrets/checkOverrides.ts
new file mode 100644
index 000000000..fae465d88
--- /dev/null
+++ b/frontend/components/utilities/secrets/checkOverrides.ts
@@ -0,0 +1,33 @@
+interface SecretDataProps {
+  type: 'personal' | 'shared';
+  pos: number;
+  key: string;
+  value: string;
+  id: string;
+  comment: string;
+}
+
+/**
+ * This function downloads the secrets as a .env file
+ * @param {object} obj 
+ * @param {SecretDataProps[]} obj.data - secrets that we want to check for overrides
+ * @returns 
+ */
+const checkOverrides = async ({ data }: { data: SecretDataProps[]; }) => {
+  let secrets : SecretDataProps[] = data!.map((secret) => Object.create(secret));
+  const overridenSecrets = data!.filter(
+    (secret) => secret.type === 'personal'
+  );
+  if (overridenSecrets.length) {
+    overridenSecrets.forEach((secret) => {
+      const index = secrets!.findIndex(
+        (_secret) => _secret.key === secret.key && _secret.type === 'shared'
+      );
+      secrets![index].value = secret.value;
+    });
+    secrets = secrets!.filter((secret) => secret.type === 'shared');
+  }
+  return secrets;
+}
+
+export default checkOverrides;
diff --git a/frontend/components/utilities/secrets/downloadDotEnv.ts b/frontend/components/utilities/secrets/downloadDotEnv.ts
new file mode 100644
index 000000000..dbb29497b
--- /dev/null
+++ b/frontend/components/utilities/secrets/downloadDotEnv.ts
@@ -0,0 +1,46 @@
+import { envMapping } from "../../../public/data/frequentConstants";
+import checkOverrides from './checkOverrides';
+
+
+interface SecretDataProps {
+  type: 'personal' | 'shared';
+  pos: number;
+  key: string;
+  value: string;
+  id: string;
+  comment: string;
+}
+
+/**
+ * This function downloads the secrets as a .env file
+ * @param {object} obj 
+ * @param {SecretDataProps[]} obj.data - secrets that we want to download
+ * @param {string} obj.env - the environment which we're downloading (used for naming the file)
+ */
+const downloadDotEnv = async ({ data, env }: { data: SecretDataProps[]; env: string; }) => {
+  if (!data) return;
+  const secrets = await checkOverrides({ data });
+
+  const file = secrets!
+    .map(
+      (item: SecretDataProps) =>
+        `${
+          item.comment
+            ? item.comment
+                .split('\n')
+                .map((comment) => '# '.concat(comment))
+                .join('\n') + '\n'
+            : ''
+        }` + [item.key, item.value].join('=')
+    )
+    .join('\n');
+
+    const blob = new Blob([file]);
+    const fileDownloadUrl = URL.createObjectURL(blob);
+    const alink = document.createElement('a');
+    alink.href = fileDownloadUrl;
+    alink.download = envMapping[env] + '.env';
+    alink.click();
+}
+
+export default downloadDotEnv;
diff --git a/frontend/components/utilities/secrets/downloadYaml.ts b/frontend/components/utilities/secrets/downloadYaml.ts
new file mode 100644
index 000000000..1c17b1410
--- /dev/null
+++ b/frontend/components/utilities/secrets/downloadYaml.ts
@@ -0,0 +1,53 @@
+// import YAML from 'yaml';
+// import { YAMLSeq } from 'yaml/types';
+
+// import { envMapping } from "../../../public/data/frequentConstants";
+// import checkOverrides from './checkOverrides';
+
+
+interface SecretDataProps {
+  type: 'personal' | 'shared';
+  pos: number;
+  key: string;
+  value: string;
+  id: string;
+  comment: string;
+}
+
+/**
+ * This function downloads the secrets as a .yml file
+ * @param {object} obj 
+ * @param {SecretDataProps[]} obj.data - secrets that we want to download
+ * @param {string} obj.env - used for naming the file
+ * @returns 
+ */
+const downloadYaml = async ({ data, env }: { data: SecretDataProps[]; env: string; }) => {
+  // if (!data) return;
+  // const doc = new YAML.Document();
+  // doc.contents = new YAMLSeq();
+  // const secrets = await checkOverrides({ data });
+  // secrets.forEach((secret) => {
+  //   const pair = YAML.createNode({ [secret.key]: secret.value });
+  //   pair.commentBefore = secret.comment
+  //     .split('\n')
+  //     .map((line) => (line ? ' '.concat(line) : ''))
+  //     .join('\n');
+  //   doc.add(pair);
+  // });
+
+  // const file = doc
+  //   .toString()
+  //   .split('\n')
+  //   .map((line) => (line.startsWith('-') ? line.replace('- ', '') : line))
+  //   .join('\n');
+
+  // const blob = new Blob([file]);
+  // const fileDownloadUrl = URL.createObjectURL(blob);
+  // const alink = document.createElement('a');
+  // alink.href = fileDownloadUrl;
+  // alink.download = envMapping[env] + '.yml';
+  // alink.click();
+  return;
+}
+
+export default downloadYaml;
diff --git a/frontend/components/utilities/secrets/encryptSecrets.ts b/frontend/components/utilities/secrets/encryptSecrets.ts
new file mode 100644
index 000000000..46c3150ef
--- /dev/null
+++ b/frontend/components/utilities/secrets/encryptSecrets.ts
@@ -0,0 +1,122 @@
+import getLatestFileKey from "~/pages/api/workspace/getLatestFileKey";
+
+const crypto = require("crypto");
+const {
+  decryptAssymmetric,
+  encryptSymmetric,
+} = require("../cryptography/crypto");
+const nacl = require("tweetnacl");
+nacl.util = require("tweetnacl-util");
+
+
+interface SecretDataProps {
+  type: 'personal' | 'shared';
+  pos: number;
+  key: string;
+  value: string;
+  id: string;
+  comment: string;
+}
+
+interface EncryptedSecretProps {
+  id: string;
+  createdAt: string;
+  environment: string;
+  secretCommentCiphertext: string;
+  secretCommentIV: string;
+  secretCommentTag: string;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  type: "personal" | "shared";
+}
+
+/**
+ * Encypt secrets before pushing the to the DB
+ * @param {object} obj 
+ * @param {object} obj.secretsToEncrypt - secrets that we want to encrypt
+ * @param {object} obj.workspaceId - the id of a project in which we are encrypting secrets
+ * @returns 
+ */
+const encryptSecrets = async ({ secretsToEncrypt, workspaceId, env }: { secretsToEncrypt: SecretDataProps[]; workspaceId: string; env: string; }) => {
+  let secrets;
+  try {
+    const sharedKey = await getLatestFileKey({ workspaceId });
+
+    const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY");
+
+    let randomBytes: string;
+    if (Object.keys(sharedKey).length > 0) {
+      // case: a (shared) key exists for the workspace
+      randomBytes = decryptAssymmetric({
+        ciphertext: sharedKey.latestKey.encryptedKey,
+        nonce: sharedKey.latestKey.nonce,
+        publicKey: sharedKey.latestKey.sender.publicKey,
+        privateKey: PRIVATE_KEY,
+      });
+    } else {
+      // case: a (shared) key does not exist for the workspace
+      randomBytes = crypto.randomBytes(16).toString("hex");
+    }
+    
+    secrets = secretsToEncrypt.map((secret) => {
+      // encrypt key
+      const {
+        ciphertext: secretKeyCiphertext,
+        iv: secretKeyIV,
+        tag: secretKeyTag,
+      } = encryptSymmetric({
+        plaintext: secret.key,
+        key: randomBytes,
+      });
+
+      // encrypt value
+      const {
+        ciphertext: secretValueCiphertext,
+        iv: secretValueIV,
+        tag: secretValueTag,
+      } = encryptSymmetric({
+        plaintext: secret.value,
+        key: randomBytes,
+      });
+
+      // encrypt comment
+      const {
+        ciphertext: secretCommentCiphertext,
+        iv: secretCommentIV,
+        tag: secretCommentTag,
+      } = encryptSymmetric({
+        plaintext: secret.comment ?? '',
+        key: randomBytes,
+      });
+
+      const result: EncryptedSecretProps = {
+        id: secret.id,
+        createdAt: '',
+        environment: env,
+        secretKeyCiphertext,
+        secretKeyIV,
+        secretKeyTag,
+        secretValueCiphertext,
+        secretValueIV,
+        secretValueTag,
+        secretCommentCiphertext,
+        secretCommentIV,
+        secretCommentTag,
+        type: secret.type,
+      };
+
+      return result;
+    });
+  } catch (error) {
+    console.log("Error while encrypting secrets");
+  }
+
+  return secrets;
+  
+}
+
+export default encryptSecrets;
diff --git a/frontend/components/utilities/secrets/getSecretsForProject.ts b/frontend/components/utilities/secrets/getSecretsForProject.ts
index 57f0e4a16..81de27be0 100644
--- a/frontend/components/utilities/secrets/getSecretsForProject.ts
+++ b/frontend/components/utilities/secrets/getSecretsForProject.ts
@@ -1,7 +1,7 @@
 import getSecrets from '~/pages/api/files/GetSecrets';
+import getLatestFileKey from '~/pages/api/workspace/getLatestFileKey';
 
 import { envMapping } from '../../../public/data/frequentConstants';
-import guidGenerator from '../randomId';
 
 const {
   decryptAssymmetric,
@@ -10,6 +10,22 @@ const {
 const nacl = require('tweetnacl');
 nacl.util = require('tweetnacl-util');
 
+interface EncryptedSecretProps {
+  _id: string;
+  createdAt: string;
+  environment: string;
+  secretCommentCiphertext: string;
+  secretCommentIV: string;
+  secretCommentTag: string;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  type: "personal" | "shared";
+}
+
 interface SecretProps { 
   key: string; 
   value: string; 
@@ -18,107 +34,102 @@ interface SecretProps {
   id: string;
 }
 
-interface Props {
+interface FunctionProps {
   env: keyof typeof envMapping;
-  setFileState: any;
   setIsKeyAvailable: any;
   setData: any;
   workspaceId: string;
 }
 
+/**
+ * Gets the secrets for a certain project
+ * @param {object} obj
+ * @param {string} obj.env - environment for which we are getting secrets
+ * @param {boolean} obj.isKeyAvailable - if a person is able to create new key pairs
+ * @param {function} obj.setData - state function that manages the state of secrets in the dashboard
+ * @param {string} obj.workspaceId - id of a workspace for which we are getting secrets
+ */
 const getSecretsForProject = async ({
   env,
-  setFileState,
   setIsKeyAvailable,
   setData,
   workspaceId
-}: Props) => {
+}: FunctionProps) => {
   try {
-    let file;
+    let encryptedSecrets;
     try {
-      file = await getSecrets(workspaceId, envMapping[env]);
-
-      setFileState(file);
+      encryptedSecrets = await getSecrets(workspaceId, envMapping[env]);
     } catch (error) {
-      console.log('ERROR: Not able to access the latest file');
+      console.log('ERROR: Not able to access the latest version of secrets');
     }
+
+    const latestKey = await getLatestFileKey({ workspaceId })
     // This is called isKeyAvailable but what it really means is if a person is able to create new key pairs
-    setIsKeyAvailable(!file.key ? file.secrets.length == 0 : true);
+    setIsKeyAvailable(!latestKey ? encryptedSecrets.length == 0 : true);
 
     const PRIVATE_KEY = localStorage.getItem('PRIVATE_KEY');
 
-    const tempFileState: SecretProps[] = [];
-    if (file.key) {
+    const tempDecryptedSecrets: SecretProps[] = [];
+    if (latestKey) {
       // assymmetrically decrypt symmetric key with local private key
       const key = decryptAssymmetric({
-        ciphertext: file.key.encryptedKey,
-        nonce: file.key.nonce,
-        publicKey: file.key.sender.publicKey,
+        ciphertext: latestKey.latestKey.encryptedKey,
+        nonce: latestKey.latestKey.nonce,
+        publicKey: latestKey.latestKey.sender.publicKey,
         privateKey: PRIVATE_KEY
       });
 
-      file.secrets.map((secretPair: any) => {
-        // decrypt .env file with symmetric key
+      // decrypt secret keys, values, and comments
+      encryptedSecrets.map((secret: EncryptedSecretProps) => {
         const plainTextKey = decryptSymmetric({
-          ciphertext: secretPair.secretKey.ciphertext,
-          iv: secretPair.secretKey.iv,
-          tag: secretPair.secretKey.tag,
+          ciphertext: secret.secretKeyCiphertext,
+          iv: secret.secretKeyIV,
+          tag: secret.secretKeyTag,
           key
         });
 
         const plainTextValue = decryptSymmetric({
-          ciphertext: secretPair.secretValue.ciphertext,
-          iv: secretPair.secretValue.iv,
-          tag: secretPair.secretValue.tag,
+          ciphertext: secret.secretValueCiphertext,
+          iv: secret.secretValueIV,
+          tag: secret.secretValueTag,
           key
         });
 
         let plainTextComment;
-        if (secretPair.secretComment.ciphertext) {
+        if (secret.secretCommentCiphertext) {
           plainTextComment = decryptSymmetric({
-            ciphertext: secretPair.secretComment.ciphertext,
-            iv: secretPair.secretComment.iv,
-            tag: secretPair.secretComment.tag,
+            ciphertext: secret.secretCommentCiphertext,
+            iv: secret.secretCommentIV,
+            tag: secret.secretCommentTag,
             key
           });
         } else {
           plainTextComment = "";
         }
 
-        tempFileState.push({
-          id: secretPair._id,
+        tempDecryptedSecrets.push({
+          id: secret._id,
           key: plainTextKey,
           value: plainTextValue,
-          type: secretPair.type,
+          type: secret.type,
           comment: plainTextComment
         });
       });
     }
-    setFileState(tempFileState);
 
-    setData(
-      tempFileState.map((line, index) => {
-        return {
-          id: line['id'],
-          pos: index,
-          key: line['key'],
-          value: line['value'],
-          type: line['type'],
-          comment: line['comment']
-        };
-      })
-    );
-
-    return tempFileState.map((line, index) => {
+    const result = tempDecryptedSecrets.map((secret, index) => {
       return {
-        id: line['id'],
+        id: secret['id'],
         pos: index,
-        key: line['key'],
-        value: line['value'],
-        type: line['type'],
-        comment: line['comment']
+        key: secret['key'],
+        value: secret['value'],
+        type: secret['type'],
+        comment: secret['comment']
       };
     });
+
+    setData(result);
+    return result;
   } catch (error) {
     console.log('Something went wrong during accessing or decripting secrets.');
   }
diff --git a/frontend/components/utilities/secrets/pushKeys.ts b/frontend/components/utilities/secrets/pushKeys.ts
deleted file mode 100644
index 1bedf357c..000000000
--- a/frontend/components/utilities/secrets/pushKeys.ts
+++ /dev/null
@@ -1,126 +0,0 @@
-import uploadSecrets from "~/pages/api/files/UploadSecrets";
-import getLatestFileKey from "~/pages/api/workspace/getLatestFileKey";
-import getWorkspaceKeys from "~/pages/api/workspace/getWorkspaceKeys";
-
-import { envMapping } from "../../../public/data/frequentConstants";
-
-const crypto = require("crypto");
-const {
-  decryptAssymmetric,
-  encryptSymmetric,
-  encryptAssymmetric,
-} = require("../cryptography/crypto");
-const nacl = require("tweetnacl");
-nacl.util = require("tweetnacl-util");
-
-export interface IK {
-  publicKey: string;
-  userId: string;
-}
-
-/**
- * This function pushes the keys to the database after decrypting them end-to-end
- * @param {object} obj 
- * @param {object} obj.obj - object with all the key pairs
- * @param {object} obj.workspaceId - the id of a project to which a user is pushing
- * @param {object} obj.env - which environment a user is pushing to 
- */
-const pushKeys = async({ obj, workspaceId, env }: { obj: object; workspaceId: string; env: string; }) => {
-  const sharedKey = await getLatestFileKey({ workspaceId });
-
-  const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY");
-
-  let randomBytes: string;
-  if (Object.keys(sharedKey).length > 0) {
-    // case: a (shared) key exists for the workspace
-    randomBytes = decryptAssymmetric({
-      ciphertext: sharedKey.latestKey.encryptedKey,
-      nonce: sharedKey.latestKey.nonce,
-      publicKey: sharedKey.latestKey.sender.publicKey,
-      privateKey: PRIVATE_KEY,
-    });
-  } else {
-    // case: a (shared) key does not exist for the workspace
-    randomBytes = crypto.randomBytes(16).toString("hex");
-  }
-
-  const secrets = Object.keys(obj).map((key) => {
-    // encrypt key
-    const {
-      ciphertext: secretKeyCiphertext,
-      iv: secretKeyIV,
-      tag: secretKeyTag,
-    } = encryptSymmetric({
-      plaintext: key.slice(1),
-      key: randomBytes,
-    });
-
-    // encrypt value
-    const {
-      ciphertext: secretValueCiphertext,
-      iv: secretValueIV,
-      tag: secretValueTag,
-    } = encryptSymmetric({
-      plaintext: obj[key as keyof typeof obj][0],
-      key: randomBytes,
-    });
-
-    // encrypt comment
-    const {
-      ciphertext: secretCommentCiphertext,
-      iv: secretCommentIV,
-      tag: secretCommentTag,
-    } = encryptSymmetric({
-      plaintext: obj[key as keyof typeof obj][1],
-      key: randomBytes,
-    });
-
-    const visibility = key.charAt(0) == "p" ? "personal" : "shared";
-
-    return {
-      secretKeyCiphertext,
-      secretKeyIV,
-      secretKeyTag,
-      secretKeyHash: crypto.createHash("sha256").update(key.slice(1)).digest("hex"),
-      secretValueCiphertext,
-      secretValueIV,
-      secretValueTag,
-      secretValueHash: crypto.createHash("sha256").update(obj[key as keyof typeof obj][0]).digest("hex"),
-      secretCommentCiphertext,
-      secretCommentIV,
-      secretCommentTag,
-      secretCommentHash: crypto.createHash("sha256").update(obj[key as keyof typeof obj][1]).digest("hex"),
-      type: visibility,
-    };
-  });
-
-  // obtain public keys of all receivers (i.e. members in workspace)
-  const publicKeys = await getWorkspaceKeys({
-    workspaceId,
-  });
-
-  // assymmetrically encrypt key with each receiver public keys
-  const keys = publicKeys.map((k: IK) => {
-    const { ciphertext, nonce } = encryptAssymmetric({
-      plaintext: randomBytes,
-      publicKey: k.publicKey,
-      privateKey: PRIVATE_KEY,
-    });
-
-    return {
-      encryptedKey: ciphertext,
-      nonce,
-      userId: k.userId,
-    };
-  });
-
-  // send payload
-  await uploadSecrets({
-    workspaceId,
-    secrets,
-    keys,
-    environment: envMapping[env as keyof typeof envMapping],
-  });
-};
-
-export default pushKeys;
diff --git a/frontend/components/utilities/secrets/pushKeysIntegration.ts b/frontend/components/utilities/secrets/pushKeysIntegration.ts
deleted file mode 100644
index 949778927..000000000
--- a/frontend/components/utilities/secrets/pushKeysIntegration.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import publicKeyInfical from '~/pages/api/auth/publicKeyInfisical';
-import changeHerokuConfigVars from '~/pages/api/integrations/ChangeHerokuConfigVars';
-
-const crypto = require('crypto');
-const {
-  encryptSymmetric,
-  encryptAssymmetric
-} = require('../cryptography/crypto');
-const nacl = require('tweetnacl');
-nacl.util = require('tweetnacl-util');
-
-interface Props {
-  obj: Record<string, string>;
-  integrationId: string;
-}
-
-const pushKeysIntegration = async ({ obj, integrationId }: Props) => {
-  const PRIVATE_KEY = localStorage.getItem('PRIVATE_KEY');
-
-  const randomBytes = crypto.randomBytes(16).toString('hex');
-
-  const secrets = Object.keys(obj).map((key) => {
-    // encrypt key
-    const {
-      ciphertext: ciphertextKey,
-      iv: ivKey,
-      tag: tagKey
-    } = encryptSymmetric({
-      plaintext: key,
-      key: randomBytes
-    });
-
-    // encrypt value
-    const {
-      ciphertext: ciphertextValue,
-      iv: ivValue,
-      tag: tagValue
-    } = encryptSymmetric({
-      plaintext: obj[key],
-      key: randomBytes
-    });
-
-    const visibility = 'shared';
-
-    return {
-      ciphertextKey,
-      ivKey,
-      tagKey,
-      hashKey: crypto.createHash('sha256').update(key).digest('hex'),
-      ciphertextValue,
-      ivValue,
-      tagValue,
-      hashValue: crypto.createHash('sha256').update(obj[key]).digest('hex'),
-      type: visibility
-    };
-  });
-
-  // obtain public keys of all receivers (i.e. members in workspace)
-  const publicKeyInfisical = await publicKeyInfical();
-
-  const publicKey = (await publicKeyInfisical.json()).publicKey;
-
-  // assymmetrically encrypt key with each receiver public keys
-
-  const { ciphertext, nonce } = encryptAssymmetric({
-    plaintext: randomBytes,
-    publicKey,
-    privateKey: PRIVATE_KEY
-  });
-
-  const key = {
-    encryptedKey: ciphertext,
-    nonce
-  };
-
-  changeHerokuConfigVars({ integrationId, key, secrets });
-};
-
-export default pushKeysIntegration;
diff --git a/frontend/ee/api/secrets/GetActionData.ts b/frontend/ee/api/secrets/GetActionData.ts
index 122870d69..4fdf18436 100644
--- a/frontend/ee/api/secrets/GetActionData.ts
+++ b/frontend/ee/api/secrets/GetActionData.ts
@@ -20,7 +20,6 @@ const getActionData = async ({ actionId }: workspaceProps) => {
       }
     }
   ).then(async (res) => {
-    console.log(188, res)
     if (res && res.status == 200) {
       return (await res.json()).action;
     } else {
diff --git a/frontend/ee/api/secrets/PerformSecretRollback.ts b/frontend/ee/api/secrets/PerformSecretRollback.ts
new file mode 100644
index 000000000..6b51410a2
--- /dev/null
+++ b/frontend/ee/api/secrets/PerformSecretRollback.ts
@@ -0,0 +1,30 @@
+import SecurityClient from '~/utilities/SecurityClient';
+
+/**
+ * This function performs a rollback of secrets in a certain project
+ * @param {object} obj
+ * @param {string} obj.workspaceId - id of the project for which we are rolling back data
+ * @param {number} obj.version - version to which we are rolling back
+ * @returns
+ */
+const performSecretRollback = async ({ workspaceId, version }: { workspaceId: string; version: number; }) => {
+  return SecurityClient.fetchCall(
+    '/api/v1/workspace/' + workspaceId + "/secret-snapshots/rollback", {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        version
+      })
+    }
+  ).then(async (res) => {
+    if (res && res.status == 200) {
+      return (await res.json());
+    } else {
+      console.log('Failed to perform the secret rollback');
+    }
+  });
+};
+
+export default performSecretRollback;
diff --git a/frontend/ee/components/ActivityTable.tsx b/frontend/ee/components/ActivityTable.tsx
index ba18afeae..207dc094f 100644
--- a/frontend/ee/components/ActivityTable.tsx
+++ b/frontend/ee/components/ActivityTable.tsx
@@ -72,10 +72,8 @@ const ActivityLogsRow = ({ row, toggleSidebar }: { row: logData, toggleSidebar:
         <td>{String(t("common:timestamp"))}</td>
         <td>{row.createdAt}</td>
       </tr>}
-      {payloadOpened &&
-      row.payload?.map((action, index) => { 
-        action.secretVersions.length > 0 &&
-        <tr key={index} className="h-9 text-bunker-200 border-mineshaft-700 border-t text-sm">
+      {payloadOpened && row.payload?.map((action, index) => {
+        return action.secretVersions.length > 0 && <tr key={index} className="h-9 text-bunker-200 border-mineshaft-700 border-t text-sm">
           <td></td>
           <td className="">{t("activity:event." + action.name)}</td>
           <td className="text-primary-300 cursor-pointer hover:text-primary duration-200" onClick={() => toggleSidebar(action._id)}>
@@ -87,7 +85,7 @@ const ActivityLogsRow = ({ row, toggleSidebar }: { row: logData, toggleSidebar:
       {payloadOpened &&
       <tr className='h-9 text-bunker-200 border-mineshaft-700 border-t text-sm'>
         <td></td>
-        <td>{String(t("common:ip-address"))}</td>
+        <td>{String(t("activity:ip-address"))}</td>
         <td>{row.ipAddress}</td>
       </tr>}
     </>
diff --git a/frontend/ee/components/PITRecoverySidebar.tsx b/frontend/ee/components/PITRecoverySidebar.tsx
index cefe2e2d1..085c483ed 100644
--- a/frontend/ee/components/PITRecoverySidebar.tsx
+++ b/frontend/ee/components/PITRecoverySidebar.tsx
@@ -111,7 +111,7 @@ const PITRecoverySidebar = ({
       }
     })
 
-    setSnapshotData({ id: secretSnapshotData._id, createdAt: secretSnapshotData.createdAt, secretVersions: decryptedSecretVersions })
+    setSnapshotData({ id: secretSnapshotData._id, version: secretSnapshotData.version, createdAt: secretSnapshotData.createdAt, secretVersions: decryptedSecretVersions })
   }
 
   return <div className={`absolute border-l border-mineshaft-500 ${isLoading ? "bg-bunker-800" : "bg-bunker"} fixed h-full w-96 top-14 right-0 z-40 shadow-xl flex flex-col justify-between`}>
diff --git a/frontend/next-i18next.config.js b/frontend/next-i18next.config.js
index 3feba4318..5f7b96e5f 100644
--- a/frontend/next-i18next.config.js
+++ b/frontend/next-i18next.config.js
@@ -5,7 +5,7 @@
  */
 module.exports = {
   // https://www.i18next.com/overview/configuration-options#logging
-  debug: process.env.NODE_ENV === "development",
+  debug: false,
   i18n: {
     defaultLocale: "en",
     locales: ["en", "ko", "fr"],
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index aca548fd7..9d04d355e 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -4,6 +4,7 @@
   "requires": true,
   "packages": {
     "": {
+      "name": "frontend",
       "dependencies": {
         "@emotion/css": "^11.10.0",
         "@emotion/server": "^11.10.0",
@@ -4639,9 +4640,9 @@
       "dev": true
     },
     "node_modules/json5": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-      "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "peer": true,
       "bin": {
         "json5": "lib/cli.js"
@@ -7454,9 +7455,9 @@
       }
     },
     "node_modules/tsconfig-paths/node_modules/json5": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-      "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+      "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
       "dev": true,
       "dependencies": {
         "minimist": "^1.2.0"
@@ -11211,9 +11212,9 @@
       "dev": true
     },
     "json5": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-      "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "peer": true
     },
     "jsonp": {
@@ -13118,9 +13119,9 @@
       },
       "dependencies": {
         "json5": {
-          "version": "1.0.1",
-          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-          "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+          "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
           "dev": true,
           "requires": {
             "minimist": "^1.2.0"
diff --git a/frontend/pages/api/files/AddSecrets.ts b/frontend/pages/api/files/AddSecrets.ts
new file mode 100644
index 000000000..cdee8e7ba
--- /dev/null
+++ b/frontend/pages/api/files/AddSecrets.ts
@@ -0,0 +1,48 @@
+import SecurityClient from '~/utilities/SecurityClient';
+
+interface EncryptedSecretProps {
+  id: string;
+  createdAt: string;
+  environment: string;
+  secretCommentCiphertext: string;
+  secretCommentIV: string;
+  secretCommentTag: string;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  type: "personal" | "shared";
+}
+
+/**
+ * This function adds secrets to a certain project
+ * @param {object} obj
+ * @param {EncryptedSecretProps} obj.secrets - the ids of secrets that we want to add
+ * @param {string} obj.env - the environment to which we are adding secrets
+ * @param {string} obj.workspaceId - the project to which we are adding secrets
+ * @returns
+ */
+const addSecrets = async ({ secrets, env, workspaceId }: { secrets: EncryptedSecretProps[]; env: string; workspaceId: string; }) => {
+  return SecurityClient.fetchCall('/api/v2/secrets', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        environment: env,
+        workspaceId,
+        secrets
+      })
+    }
+  ).then(async (res) => {
+    if (res && res.status == 200) {
+      return await res.json();
+    } else {
+      console.log('Failed to add certain project secrets');
+    }
+  });
+};
+
+export default addSecrets;
diff --git a/frontend/pages/api/files/DeleteSecrets.ts b/frontend/pages/api/files/DeleteSecrets.ts
new file mode 100644
index 000000000..cc178b7bb
--- /dev/null
+++ b/frontend/pages/api/files/DeleteSecrets.ts
@@ -0,0 +1,27 @@
+import SecurityClient from '~/utilities/SecurityClient';
+
+/**
+ * This function deletes certain secrets from a certain project
+ * @param {string[]} secretIds - the ids of secrets that we want to be deleted
+ * @returns
+ */
+const deleteSecrets = async ({ secretIds }: { secretIds: string[] }) => {
+  return SecurityClient.fetchCall('/api/v2/secrets', {
+      method: 'DELETE',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        secretIds
+      })
+    }
+  ).then(async (res) => {
+    if (res && res.status == 200) {
+      return await res.json();
+    } else {
+      console.log('Failed to delete certain project secrets');
+    }
+  });
+};
+
+export default deleteSecrets;
diff --git a/frontend/pages/api/files/GetSecrets.ts b/frontend/pages/api/files/GetSecrets.ts
index 8ff22b57c..2fed6a400 100644
--- a/frontend/pages/api/files/GetSecrets.ts
+++ b/frontend/pages/api/files/GetSecrets.ts
@@ -1,19 +1,17 @@
 import SecurityClient from '~/utilities/SecurityClient';
 
 /**
- * This function fetches the encrypted secrets from the .env file
+ * This function fetches the encrypted secrets for a certain project
  * @param {string} workspaceId - project is for which a user is trying to get secrets
  * @param {string} env - environment of a project for which a user is trying ot get secrets
  * @returns
  */
 const getSecrets = async (workspaceId: string, env: string) => {
   return SecurityClient.fetchCall(
-    '/api/v1/secret/' +
-      workspaceId +
-      '?' +
+    '/api/v2/secrets?' +
       new URLSearchParams({
         environment: env,
-        channel: 'web'
+        workspaceId
       }),
     {
       method: 'GET',
@@ -23,7 +21,7 @@ const getSecrets = async (workspaceId: string, env: string) => {
     }
   ).then(async (res) => {
     if (res && res.status == 200) {
-      return await res.json();
+      return (await res.json()).secrets;
     } else {
       console.log('Failed to get project secrets');
     }
diff --git a/frontend/pages/api/files/UpdateSecrets.ts b/frontend/pages/api/files/UpdateSecrets.ts
new file mode 100644
index 000000000..2ec67fc2e
--- /dev/null
+++ b/frontend/pages/api/files/UpdateSecrets.ts
@@ -0,0 +1,44 @@
+import SecurityClient from '~/utilities/SecurityClient';
+
+interface EncryptedSecretProps {
+  id: string;
+  createdAt: string;
+  environment: string;
+  secretCommentCiphertext: string;
+  secretCommentIV: string;
+  secretCommentTag: string;
+  secretKeyCiphertext: string;
+  secretKeyIV: string;
+  secretKeyTag: string;
+  secretValueCiphertext: string;
+  secretValueIV: string;
+  secretValueTag: string;
+  type: "personal" | "shared";
+}
+
+/**
+ * This function updates certain secrets in a certain project
+ * @param {object} obj
+ * @param {EncryptedSecretProps[]} obj.secrets - the ids of secrets that we want to update
+ * @returns
+ */
+const updateSecrets = async ({ secrets }: { secrets: EncryptedSecretProps[] }) => {
+  return SecurityClient.fetchCall('/api/v2/secrets', {
+      method: 'PATCH',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        secrets
+      })
+    }
+  ).then(async (res) => {
+    if (res && res.status == 200) {
+      return await res.json();
+    } else {
+      console.log('Failed to update certain project secrets');
+    }
+  });
+};
+
+export default updateSecrets;
diff --git a/frontend/pages/dashboard/[id].tsx b/frontend/pages/dashboard/[id].tsx
index f46c0cae5..cb3717f68 100644
--- a/frontend/pages/dashboard/[id].tsx
+++ b/frontend/pages/dashboard/[id].tsx
@@ -9,7 +9,6 @@ import {
   faArrowLeft,
   faCheck,
   faClockRotateLeft,
-  faDownload,
   faEye,
   faEyeSlash,
   faFolderOpen,
@@ -17,31 +16,33 @@ import {
   faPlus,
 } from '@fortawesome/free-solid-svg-icons';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
-import { Menu, Transition } from '@headlessui/react';
 import getProjectSercetSnapshotsCount from 'ee/api/secrets/GetProjectSercetSnapshotsCount';
+import performSecretRollback from 'ee/api/secrets/PerformSecretRollback';
 import PITRecoverySidebar from 'ee/components/PITRecoverySidebar';
-import { Document, YAMLSeq } from 'yaml';
 
 import Button from '~/components/basic/buttons/Button';
 import ListBox from '~/components/basic/Listbox';
 import BottonRightPopup from '~/components/basic/popups/BottomRightPopup';
 import { useNotificationContext } from '~/components/context/Notifications/NotificationProvider';
+import DownloadSecretMenu from '~/components/dashboard/DownloadSecretsMenu';
 import DropZone from '~/components/dashboard/DropZone';
 import KeyPair from '~/components/dashboard/KeyPair';
 import SideBar from '~/components/dashboard/SideBar';
 import NavHeader from '~/components/navigation/NavHeader';
+import encryptSecrets from '~/components/utilities/secrets/encryptSecrets';
 import getSecretsForProject from '~/components/utilities/secrets/getSecretsForProject';
-import pushKeys from '~/components/utilities/secrets/pushKeys';
 import { getTranslatedServerSideProps } from '~/components/utilities/withTranslateProps';
 import guidGenerator from '~/utilities/randomId';
 
 import { envMapping, reverseEnvMapping } from '../../public/data/frequentConstants';
+import addSecrets from '../api/files/AddSecrets';
+import deleteSecrets from '../api/files/DeleteSecrets';
+import updateSecrets from '../api/files/UpdateSecrets';
 import getUser from '../api/user/getUser';
 import checkUserAction from '../api/userActions/checkUserAction';
 import registerUserAction from '../api/userActions/registerUserAction';
 import getWorkspaces from '../api/workspace/getWorkspaces';
 
-const queryString = require("query-string");
 
 interface SecretDataProps {
   type: 'personal' | 'shared';
@@ -52,9 +53,18 @@ interface SecretDataProps {
   comment: string;
 }
 
+interface overrideProps {
+  id: string;
+  keyName: string;
+  value: string;
+  pos: number;
+  comment: string;
+}
+
 interface SnapshotProps {
   id: string;
   createdAt: string;
+  version: number;
   secretVersions: {
     id: string;
     pos: number;
@@ -89,7 +99,7 @@ function findDuplicates(arr: any[]) {
  */
 export default function Dashboard() {
   const [data, setData] = useState<SecretDataProps[] | null>();
-  const [fileState, setFileState] = useState<SecretDataProps[]>([]);
+  const [initialData, setInitialData] = useState<SecretDataProps[]>([]); 
   const [buttonReady, setButtonReady] = useState(false);
   const router = useRouter();
   const [workspaceId, setWorkspaceId] = useState('');
@@ -196,11 +206,11 @@ export default function Dashboard() {
 
         const dataToSort = await getSecretsForProject({
           env,
-          setFileState,
           setIsKeyAvailable,
           setData,
           workspaceId: String(router.query.id)
         });
+        setInitialData(dataToSort);
         reorderRows(dataToSort);
 
         setSharedToHide(
@@ -236,14 +246,6 @@ export default function Dashboard() {
     ]);
   };
 
-  interface overrideProps {
-    id: string;
-    keyName: string;
-    value: string;
-    pos: number;
-    comment: string;
-  }
-
   /**
    * This function add an ovverrided version of a certain secret to the current user
    * @param {object} obj 
@@ -275,12 +277,12 @@ export default function Dashboard() {
       text: `${secretName} has been deleted. Remember to save changes.`,
       type: 'error'
     });
-    setData(data!.filter((row: SecretDataProps) => !ids.includes(row.id)));
+    sortValuesHandler(data!.filter((row: SecretDataProps) => !ids.includes(row.id)), sortMethod == "alhpabetical" ? "-alphabetical" : "alphabetical");
   };
 
   /**
    * This function deleted the override of a certain secrer
-   * @param {string} id - id of a secret to be deleted
+   * @param {string} id - id of a shared secret; the override with the same key should be deleted
    */
   const deleteOverride = (id: string) => {
     setButtonReady(true);
@@ -293,7 +295,7 @@ export default function Dashboard() {
     setSharedToHide(sharedToHide!.filter(tempId => tempId != sharedVersionOfOverride))
 
     // resort secrets
-    const tempData = data!.filter((row: SecretDataProps) => !(row.id == id && row.type == 'personal'))
+    const tempData = data!.filter((row: SecretDataProps) => !(row.key == data!.filter(row => row.id == id)[0]?.key && row.type == 'personal'))
     sortValuesHandler(tempData, sortMethod == "alhpabetical" ? "-alphabetical" : "alphabetical")
   };
 
@@ -313,14 +315,6 @@ export default function Dashboard() {
     setButtonReady(true);
   };
 
-  const modifyVisibility = (value: "shared" | "personal", pos: number) => {
-    setData((oldData) => {
-      oldData![pos].type = value;
-      return [...oldData!];
-    });
-    setButtonReady(true);
-  };
-
   const modifyComment = (value: string, pos: number) => {
     setData((oldData) => {
       oldData![pos].comment = value;
@@ -338,10 +332,6 @@ export default function Dashboard() {
     modifyKey(value, pos);
   }, []);
 
-  const listenChangeVisibility = useCallback((value: "shared" | "personal", pos: number) => {
-    modifyVisibility(value, pos);
-  }, []);
-
   const listenChangeComment = useCallback((value: string, pos: number) => {
     modifyComment(value, pos);
   }, []);
@@ -349,22 +339,20 @@ export default function Dashboard() {
   /**
    * Save the changes of environment variables and push them to the database
    */
-  const savePush = async (dataToPush?: any[], envToPush?: string) => {
-    let obj;
+  const savePush = async (dataToPush?: SecretDataProps[]) => {
+    let newData: SecretDataProps[] | null | undefined;
     // dataToPush is mostly used for rollbacks, otherwise we always take the current state data
     if ((dataToPush ?? [])?.length > 0) {
-      obj = Object.assign(
-        {},
-        ...dataToPush!.map((row: SecretDataProps) => ({ [row.type.charAt(0) + row.key]: [row.value, row.comment ?? ''] }))
-      );
+      newData = dataToPush;
     } else {
-      // Format the new object with environment variables
-      obj = Object.assign(
-        {},
-        ...data!.map((row: SecretDataProps) => ({ [row.type.charAt(0) + row.key]: [row.value, row.comment ?? ''] }))
-      );
+      newData = data;
     }
 
+    const obj = Object.assign(
+      {},
+      ...newData!.map((row: SecretDataProps) => ({ [row.type.charAt(0) + row.key]: [row.value, row.comment ?? ''] }))
+    );
+
     // Checking if any of the secret keys start with a number - if so, don't do anything
     const nameErrors = !Object.keys(obj)
       .map((key) => !isNaN(Number(key[0].charAt(0))))
@@ -385,10 +373,37 @@ export default function Dashboard() {
       });
     }
 
-    // Once "Save changed is clicked", disable that button
+    // Once "Save changes" is clicked, disable that button
     setButtonReady(false);
-    console.log(envToPush ? envToPush : env, env, envToPush)
-    pushKeys({ obj, workspaceId: String(router.query.id), env: envToPush ? envToPush : env });
+
+    const secretsToBeDeleted 
+      = initialData
+      .filter(initDataPoint => !newData!.map(newDataPoint => newDataPoint.id).includes(initDataPoint.id))
+      .map(secret => secret.id);
+
+    const secretsToBeAdded 
+      = newData!
+      .filter(newDataPoint => !initialData.map(initDataPoint => initDataPoint.id).includes(newDataPoint.id));
+
+    const secretsToBeUpdated 
+      = newData!.filter(newDataPoint => initialData
+      .filter(initDataPoint => newData!.map(newDataPoint => newDataPoint.id).includes(initDataPoint.id) 
+        && (newData!.filter(newDataPoint => newDataPoint.id == initDataPoint.id)[0].value != initDataPoint.value
+        || newData!.filter(newDataPoint => newDataPoint.id == initDataPoint.id)[0].key != initDataPoint.key
+        || newData!.filter(newDataPoint => newDataPoint.id == initDataPoint.id)[0].comment != initDataPoint.comment))
+      .map(secret => secret.id).includes(newDataPoint.id));
+    
+    if (secretsToBeDeleted.length > 0) {
+      await deleteSecrets({ secretIds: secretsToBeDeleted });
+    }
+    if (secretsToBeAdded.length > 0) {
+      const secrets = await encryptSecrets({ secretsToEncrypt: secretsToBeAdded, workspaceId, env: envMapping[env] })
+      secrets && await addSecrets({ secrets, env: envMapping[env], workspaceId });
+    }
+    if (secretsToBeUpdated.length > 0) {
+      const secrets = await encryptSecrets({ secretsToEncrypt: secretsToBeUpdated, workspaceId, env: envMapping[env] })
+      secrets && await updateSecrets({ secrets });
+    }
 
     // If this user has never saved environment variables before, show them a prompt to read docs
     if (!hasUserEverPushed) {
@@ -426,79 +441,7 @@ export default function Dashboard() {
 
     setData(sortedData);
   };
-
-  // check if there are secrets with an override
-  const checkOverrides = (data: SecretDataProps[]) => {
-    let secrets : SecretDataProps[] = data!.map((secret) => Object.create(secret));
-    const overridenSecrets = data!.filter(
-      (secret) => secret.type === 'personal'
-    );
-    if (overridenSecrets.length) {
-      overridenSecrets.forEach((secret) => {
-        const index = secrets!.findIndex(
-          (_secret) => _secret.key === secret.key && _secret.type === 'shared'
-        );
-        secrets![index].value = secret.value;
-      });
-      secrets = secrets!.filter((secret) => secret.type === 'shared');
-    }
-    return secrets;
-  };
-  // This function downloads the secrets as a .env file
-  const downloadDotEnv = () => {
-    if (!data) return;
-    const secrets = checkOverrides(data)
-
-    const file = secrets!
-      .map(
-        (item: SecretDataProps) =>
-          `${
-            item.comment
-              ? item.comment
-                  .split('\n')
-                  .map((comment) => '# '.concat(comment))
-                  .join('\n') + '\n'
-              : ''
-          }` + [item.key, item.value].join('=')
-      )
-      .join('\n');
-
-        const blob = new Blob([file]);
-        const fileDownloadUrl = URL.createObjectURL(blob);
-        const alink = document.createElement('a');
-        alink.href = fileDownloadUrl;
-        alink.download = envMapping[env] + '.env';
-        alink.click();
-  };
-
-  // This function downloads the secrets as a .yml file
-  const downloadYaml = () => {
-    if (!data) return;
-    const doc = new Document(new YAMLSeq());
-    const secrets = checkOverrides(data);
-    secrets.forEach((secret) => {
-      const pair = doc.createNode({ [secret.key]: secret.value });
-      pair.commentBefore = secret.comment
-        .split('\n')
-        .map((line) => (line ? ' '.concat(line) : ''))
-        .join('\n');
-      doc.add(pair);
-    });
-
-    const file = doc
-      .toString()
-      .split('\n')
-      .map((line) => (line.startsWith('-') ? line.replace('- ', '') : line))
-      .join('\n');
-
-    const blob = new Blob([file]);
-    const fileDownloadUrl = URL.createObjectURL(blob);
-    const alink = document.createElement('a');
-    alink.href = fileDownloadUrl;
-    alink.download = envMapping[env] + '.yml';
-    alink.click();
-  };
-
+  
   const deleteCertainRow = ({ ids, secretName }: { ids: string[]; secretName: string; }) => {
     deleteRow({ids, secretName});
   };
@@ -596,31 +539,29 @@ export default function Dashboard() {
                 <Button
                   text={String(t("Rollback to this snapshot"))}
                   onButtonPressed={async () => {
-                    const envsToRollback = snapshotData.secretVersions.map(sv => sv.environment).filter((v, i, a) => a.indexOf(v) === i);
-
                     // Update secrets in the state only for the current environment
-                    setData(
-                      snapshotData.secretVersions
-                      .filter(row => reverseEnvMapping[row.environment] == env)
-                      .map((sv, position) => { 
-                        return {
-                          id: sv.id, pos: position, type: sv.type, key: sv.key, value: sv.value, comment: ''
-                        }
-                      })
-                    );
-
-                    // Rollback each of the environments in the snapshot
-                    // #TODO: clean up other environments
-                    envsToRollback.map(async (envToRollback) => {
-                      await savePush(
-                        snapshotData.secretVersions
-                        .filter(row => row.environment == envToRollback)
-                        .map((sv, position) => { 
-                          return {id: sv.id, pos: position, type: sv.type, key: sv.key, value: sv.value, comment: ''}
-                        }),
-                        reverseEnvMapping[envToRollback]
-                      );
+                    const rolledBackSecrets = snapshotData.secretVersions
+                    .filter(row => reverseEnvMapping[row.environment] == env)
+                    .map((sv, position) => { 
+                      return {
+                        id: sv.id, pos: position, type: sv.type, key: sv.key, value: sv.value, comment: ''
+                      }
                     });
+                    setData(rolledBackSecrets);
+
+                    setSharedToHide(
+                      rolledBackSecrets?.filter(row => (rolledBackSecrets
+                      ?.map((item) => item.key)
+                      .filter(
+                        (item, index) =>
+                          index !==
+                          rolledBackSecrets?.map((item) => item.key).indexOf(item)
+                      ).includes(row.key) && row.type == 'shared'))?.map((item) => item.id)
+                    )
+
+                    // Perform the rollback globally
+                    performSecretRollback({ workspaceId, version: snapshotData.version })
+
                     setSnapshotData(undefined);
                     createNotification({
                       text: `Rollback has been performed successfully.`,
@@ -675,50 +616,7 @@ export default function Dashboard() {
                       />
                     </div>}
                     {!snapshotData && <div className="ml-2 min-w-max flex flex-row items-start justify-start">
-                      <Menu
-                        as="div"
-                        className="relative inline-block text-left"
-                      >
-                        <Menu.Button
-                          as="div"
-                          className="inline-flex w-full justify-center  text-sm font-medium text-gray-200 rounded-md hover:bg-white/10 duration-200 focus:outline-none focus-visible:ring-2 focus-visible:ring-white focus-visible:ring-opacity-75"
-                        >
-                          <Button
-                            color="mineshaft"
-                            size="icon-md"
-                            icon={faDownload}
-                            onButtonPressed={() => {}}
-                          />
-                        </Menu.Button>
-                        <Transition
-                          as={Fragment}
-                          enter="transition ease-out duration-100"
-                          enterFrom="transform opacity-0 scale-95"
-                          enterTo="transform opacity-100 scale-100"
-                          leave="transition ease-in duration-75"
-                          leaveFrom="transform opacity-100 scale-100"
-                          leaveTo="transform opacity-0 scale-95"
-                        >
-                          <Menu.Items className="absolute z-50 drop-shadow-xl right-0 mt-0.5 w-[20rem] origin-top-right rounded-md bg-bunker border border-mineshaft-500 shadow-lg ring-1 ring-black ring-opacity-5 focus:outline-none p-2 space-y-2">
-                            <Menu.Item>
-                              <Button
-                                color="mineshaft"
-                                onButtonPressed={downloadDotEnv}
-                                size="md"
-                                text="Download as .env"
-                              />
-                            </Menu.Item>
-                            <Menu.Item>
-                              <Button
-                                color="mineshaft"
-                                onButtonPressed={downloadYaml}
-                                size="md"
-                                text="Download as .yml"
-                              />
-                            </Menu.Item>
-                          </Menu.Items>
-                        </Transition>
-                      </Menu>
+                      <DownloadSecretMenu data={data} env={env} />
                     </div>}
                     <div className="ml-2 min-w-max flex flex-row items-start justify-start">
                       <Button
@@ -763,7 +661,7 @@ export default function Dashboard() {
                   className={`max-w-5xl mt-1 max-h-[calc(100vh-280px)] overflow-hidden overflow-y-scroll no-scrollbar no-scrollbar::-webkit-scrollbar`}
                 >
                   <div className="px-1 pt-2 bg-mineshaft-800 rounded-md p-2">
-                    {!snapshotData && data?.filter(row => row.key.toUpperCase().includes(searchKeys.toUpperCase()))
+                    {!snapshotData && data?.filter(row => row.key?.toUpperCase().includes(searchKeys.toUpperCase()))
                     .filter(row => !(sharedToHide.includes(row.id) && row.type == 'shared')).map((keyPair) => (
                       <KeyPair 
                         key={keyPair.id}
@@ -831,7 +729,6 @@ export default function Dashboard() {
                   />
                 )}
                 {
-                // fileState.message == 'Access needed to pull the latest file' ||
                   (!isKeyAvailable && (
                     <>
                       <FontAwesomeIcon