function: secrets-management
120 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Vault HashiCorp Vault is a secrets management server that securely stores, generates, and controls access to credentials, certificates, and encry… | 98 | 36180 | stable |
| trufflesecurity/trufflehog TruffleHog is an open-source secrets scanning tool that discovers, classifies, validates, and analyzes leaked credentials across Git reposi… | 95 | 27599 | active |
| Pulumi Pulumi is an open-source infrastructure-as-code platform that lets you define, deploy, and manage cloud infrastructure using general-purpos… | 95 | 25612 | stable |
| getsops/sops SOPS is a CLI tool for encrypting and decrypting configuration files (YAML, JSON, ENV, INI, and binary) while keeping keys and structure vi… | 97 | 22932 | stable |
| twpayne/chezmoi chezmoi is a CLI tool for managing personal configuration files (dotfiles) across multiple machines, written in Go and distributed as a sin… | 98 | 21325 | stable |
| motdotla/dotenv A zero-dependency Node.js module that loads environment variables from a .env file into process.env, following the Twelve-Factor App config… | 75 | 20525 | stable |
| direnv/direnv direnv is a shell extension that loads and unloads environment variables based on the current directory by evaluating an authorized .envrc … | 64 | 15401 | stable |
| Bitwarden Bitwarden's server backend providing the APIs, database, and infrastructure behind the Bitwarden password manager. It can be self-hosted vi… | 95 | 13674 | active |
| bitnami/sealed-secrets A Kubernetes controller plus the kubeseal CLI that lets you encrypt Kubernetes Secrets into one-way encrypted SealedSecrets that are safe t… | 99 | 9256 | active |
| MightyMoud/sidekick Sidekick is a Go CLI tool that turns a bare Ubuntu VPS into a production-ready application hosting platform, similar to fly.io or Heroku bu… | 54 | 7597 | active |
| openbao/openbao OpenBao is an open-source, identity-based secrets management system for storing, distributing, and rotating sensitive data such as secrets,… | 93 | 7177 | active |
| external-secrets/external-secrets External Secrets Operator is a Kubernetes operator that synchronizes secrets from external secret management systems such as AWS Secrets Ma… | 94 | 6808 | stable |
| dotenvx/dotenvx Dotenvx is a secure, cross-platform CLI and SDK for managing .env files, adding encryption so secrets can be safely committed to git and de… | 89 | 5707 | active |
| dynaconf/dynaconf Dynaconf is a configuration management library for Python inspired by the 12-factor app guide. It supports multiple file formats (toml, yam… | 98 | 4327 | stable |
| dmno-dev/varlock Varlock is a CLI tool and library for managing environment variables and secrets via a typed .env.schema file, serving as a drop-in dotenv … | 82 | 4220 | active |
| sobolevn/git-secret git-secret is a bash-based command-line tool that encrypts private files with GPG public keys and stores them safely inside a git repositor… | 67 | 4038 | active |
| onecli/onecli OneCLI is an open-source platform that gives every employee a personal, sandboxed AI agent, with all tool calls routed through a gateway th… | 77 | 3415 | active |
| tellerops/teller Teller is an open-source, developer-first CLI secret manager written in Rust that fetches secrets from multiple providers (HashiCorp Vault,… | 52 | 3227 | active |
| Mic92/sops-nix sops-nix is a NixOS module that provides atomic, declarative secret provisioning based on Mozilla's sops. It decrypts sops-encrypted files … | 67 | 3130 | active |
| onetimesecret/onetimesecret A self-hostable web service for sharing sensitive information like passwords via single-use, self-destructing links. Written in Ruby with R… | 95 | 2912 | active |
| awnumar/memguard MemGuard is a pure Go library that securely stores sensitive information in memory, encrypting it with XSalsa20Poly1305 and bypassing the g… | 72 | 2756 | active |
| segmentio/chamber Chamber is a Go CLI tool for managing application secrets by storing them in AWS SSM Parameter Store (with S3 backend support). It lets tea… | 77 | 2614 | active |
| ryantm/agenix Agenix is a Nix library and CLI tool for managing age-encrypted secrets in NixOS and Home Manager using existing SSH public/private key pai… | 52 | 2468 | active |
| bank-vaults/bank-vaults Bank-Vaults is a CNCF Sandbox umbrella project of tools for cloud-native secret management with Hashicorp Vault. This repository provides t… | 86 | 2267 | active |
| Infisical/agent-vault Agent Vault is an open-source HTTP credential proxy and vault by Infisical that sits between AI agents and the APIs they call. It stores cr… | 80 | 2141 | active |
| jdx/fnox fnox is a Rust CLI tool for managing secrets via encryption or cloud secret providers, storing them in a git-committed fnox.toml file. It s… | 84 | 2098 | active |
| hashicorp/envconsul Envconsul is a Go CLI tool that launches a subprocess with environment variables populated from HashiCorp Consul key-value data and Vault s… | 82 | 2071 | active |
| jkroepke/helm-secrets helm-secrets is a Helm plugin that transparently encrypts and decrypts Helm value files using sops, allowing secrets to be safely stored in… | 95 | 2025 | active |
| 1Password/for-open-source 1Password for Open Source is a program that grants eligible open source projects a free 1Password Teams account for securely storing and sh… | 67 | 1927 | active |
| kapicorp/kapitan Kapitan is a Python CLI tool for templated, inventory-driven configuration management that compiles Jsonnet, Jinja2, Kadet, Helm, Kustomize… | 95 | 1925 | active |
| betterleaks/betterleaks Betterleaks is a fast, configurable secrets scanner for finding leaked credentials in git repositories, filesystems, and platforms like Git… | 82 | 1792 | active |
| elasticdog/transcrypt A single Bash script that configures transparent encryption of sensitive files in a Git repository using Git's clean/smudge filters and Ope… | 80 | 1708 | stable |
| configu/configu Configu is an open-source ConfigOps infrastructure for managing and collaborating on software configuration data such as environment variab… | 74 | 1684 | active |
| drduh/pwd.sh pwd.sh is a single Bash script that manages text secrets such as passwords using GnuPG symmetric encryption. Secrets are stored in randomly… | 88 | 1564 | active |
| kubernetes-sigs/secrets-store-csi-driver A Kubernetes CSI driver that mounts secrets, keys, and certificates from external secrets stores (Vault, Azure Key Vault, AWS Secrets Manag… | 86 | 1557 | stable |
| docker/mcp-gateway A Docker CLI plugin (docker-mcp) that provides the Docker MCP Gateway for securely running and deploying Model Context Protocol (MCP) serve… | 73 | 1543 | active |
| Shopify/ejson EJSON is a Go CLI utility for managing encrypted secrets in JSON files using asymmetric elliptic-curve (NaCl Box) encryption. It lets teams… | 86 | 1480 | stable |
| OWASP/wrongsecrets OWASP WrongSecrets is a deliberately vulnerable Java application containing 50+ challenges that demonstrate how secrets are commonly miscon… | 94 | 1459 | active |
| cachix/secretspec SecretSpec is a declarative tool and library for defining the secrets an application needs in a secretspec.toml manifest and resolving them… | 84 | 1407 | active |
| hvac/hvac hvac is a Python 3.x client library for the HashiCorp Vault HTTP API. It lets Python applications authenticate to Vault and read, write, an… | 55 | 1315 | active |
| docker/docker-credential-helpers A suite of Go programs that store Docker login credentials in native platform keystores (e.g., macOS Keychain, Windows Credential Manager, … | 95 | 1310 | active |
| GoogleCloudPlatform/berglas Berglas is a command line tool and Go library for managing secrets on Google Cloud, encrypting them with Cloud KMS and storing them in Clou… | 94 | 1302 | active |
| google/secrets-gradle-plugin A Gradle plugin by Google that injects secrets from a properties file (like local.properties) not checked into version control into BuildCo… | 23 | 1282 | stable |
| pinterest/knox Knox is a self-hosted secret management service written in Go that stores, serves, and rotates secrets, keys, and credentials used by other… | 64 | 1268 | active |
| mongodb/kingfisher Kingfisher is an open-source, Rust-based secret scanner that detects leaked credentials in code, Git history, cloud storage, and developer … | 82 | 1214 | active |
| mittwald/kubernetes-replicator A custom Kubernetes controller written in Go that synchronizes Secrets, ConfigMaps, Roles, RoleBindings, and ServiceAccounts across namespa… | 85 | 1114 | active |
| laserlemon/figaro Figaro is a Ruby gem that provides simple, Heroku-friendly configuration for Rails applications using environment variables and a single Gi… | 45 | 3745 | maintenance |
| fugue/credstash CredStash is a Python CLI utility for managing and distributing shared credentials in the cloud, encrypting secrets with AWS KMS key wrappi… | 23 | 2064 | maintenance |
| Noovolari/leapp Leapp is a cross-platform Electron desktop app for managing and generating cloud credentials across multiple AWS and Azure accounts, with e… | 60 | 1775 | maintenance |
| mprimi/portable-secret Portable Secret is a tool that packs an encrypted payload and decryption JavaScript into a single self-contained HTML file, using the brows… | 32 | 1738 | maintenance |
| orta/cocoapods-keys A CocoaPods plugin that stores per-developer environment and application keys securely in the macOS keychain instead of source code. On pod… | 32 | 1548 | maintenance |
| cloud66-oss/habitus Habitus is a standalone command-line build flow tool for Docker that orchestrates chained, multi-step Docker image builds defined in a buil… | 23 | 1400 | maintenance |
| sorah/envchain envchain is a command-line tool that stores environment variables like API credentials in macOS Keychain or the D-Bus Secret Service (gnome… | 23 | 1326 | maintenance |
| dotenv-org/dotenv-vault dotenv-vault is a CLI and cloud service for syncing .env files across machines, environments, and team members, with encrypted .env.vault d… | 35 | 1245 | maintenance |
| earendil-works/gondolin Gondolin is a TypeScript library and CLI that runs untrusted AI-agent code inside fast local Linux micro-VMs (QEMU by default, optional lib… | 73 | 2034 | experimental |
| cloud-gouv/securix SécurixOS is a NixOS-based hardened Linux distribution for secure workstations, developed by the French DINUM for sysadmin, office, and dev… | 88 | 1029 | experimental |
| 99designs/aws-vault AWS Vault is a CLI tool that securely stores AWS IAM credentials in the operating system's native keystore (macOS Keychain, Windows Credent… | 49 | 8985 | abandoned |
| StackExchange/blackbox BlackBox is a CLI tool that uses GPG to encrypt specific files in a Git, Mercurial, Subversion, or Perforce repository so secrets are encry… | 10 | 6770 | abandoned |
| square/keywhiz Keywhiz is a Java-based system for centrally storing, managing, and distributing secrets such as TLS keys, API tokens, and database credent… | 10 | 2623 | abandoned |
| external-secrets/kubernetes-external-secrets A Kubernetes controller that syncs secrets from external secret management systems like AWS Secrets Manager and HashiCorp Vault into native… | 10 | 2580 | abandoned |
| Caiyeon/goldfish Goldfish is a web-based UI and workflow tool for HashiCorp Vault, built with VueJS on the frontend and a Go backend using Vault's native AP… | 10 | 2127 | abandoned |
| lyft/confidant Confidant is a secret management service from Lyft that stores secrets encrypted at rest in AWS DynamoDB, with a web UI and client tooling.… | 10 | 1856 | abandoned |
| zendesk/helm-secrets A deprecated Helm plugin that manages encrypted secrets files (YAML/JSON) within Git workflows, using SOPS as its backend for per-value enc… | 10 | 1146 | abandoned |
| Trivy Trivy is an all-in-one open-source security scanner that finds vulnerabilities (CVEs), IaC misconfigurations, secrets, and software license… | 98 | 37636 | stable |
| Infisical/infisical Infisical is an open-source platform for secrets management, certificate lifecycle management, KMS, and privileged access management, usabl… | 95 | 28981 | stable |
| Dapr Dapr is a portable, CNCF-graduated distributed application runtime that runs as a sidecar and exposes building-block APIs for service invoc… | 99 | 26037 | stable |
| gravitational/teleport Teleport is an identity-aware access proxy and certificate authority that provides unified, credential-free access to SSH servers, Kubernet… | 93 | 20852 | stable |
| windmill-labs/windmill Windmill is an open-source, self-hostable developer platform that turns scripts in Python, TypeScript, Go, Bash, SQL and other languages in… | 95 | 17687 | active |
| dagger/dagger Dagger is a programmable automation engine for building, testing, and shipping software, replacing YAML pipelines with real code via SDKs i… | 95 | 16203 | active |
| yc-software/qm QM is a self-hostable multiplayer agent harness that lets every employee in a company work with AI agents in personal and shared scopes acr… | 79 | 14236 | active |
| semaphoreui/semaphore Semaphore UI is an open-source, self-hosted web UI and API for running Ansible playbooks, Terraform/OpenTofu/Terragrunt, Bash, PowerShell, … | 95 | 14058 | active |
| encoredev/encore Encore is an open-source infrastructure SDK and backend framework for TypeScript and Go that lets developers declare resources like databas… | 95 | 12307 | active |
| AGWA/git-crypt git-crypt is a command-line tool that provides transparent encryption and decryption of selected files in a git repository. It lets teams s… | 45 | 9871 | active |
| shuttle-hq/shuttle Shuttle is a Rust-native cloud development platform and framework that lets developers build and deploy backends without writing infrastruc… | 10 | 6926 | active |
| Passbolt Passbolt Community Edition API is the JSON backend for the open source, security-first password manager for teams, built in PHP on CakePHP.… | 98 | 6095 | stable |
| aidlearning/AidLearning-FrameWork AidLux (originally AidLearning) is an AIoT development platform that runs a native Ubuntu Linux environment with GUI, deep learning tooling… | 70 | 5797 | active |
| agentscope-ai/AgentTeams AgentTeams is an open-source collaborative multi-agent runtime platform that orchestrates multiple Agent containers using a Manager-Workers… | 81 | 5492 | active |
| Nasiko-Labs/nasiko Nasiko is a developer control plane for AI agents, built in Rust, that lets teams deploy, route, secure, and observe A2A-speaking agents wi… | 61 | 5330 | active |
| ThreatMapper Deepfence ThreatMapper is an open-source Cloud Native Application Protection Platform (CNAPP) that hunts threats in production cloud, Kuber… | 84 | 5318 | active |
| SaladDay/cc-switch-cli A cross-platform CLI and interactive TUI tool for managing configurations of AI coding assistants like Claude Code, Codex, and Gemini CLI. … | 79 | 4854 | active |
| cloudflare/workers-sdk The Cloudflare Workers SDK is a monorepo containing Wrangler, the official CLI for building, testing, and deploying Cloudflare Workers serv… | 95 | 4475 | active |
| hashicorp/boundary HashiCorp Boundary is an identity-aware proxy that provides secure, least-privilege access to hosts and critical systems across clouds and … | 89 | 4056 | active |
| octelium/octelium Octelium is a free, open-source, self-hosted unified zero trust secure access platform built on Kubernetes. It can operate as a remote acce… | 86 | 4025 | active |
| nolabs-ai/nono nono is a Rust-based CLI and SDK that runs AI coding agents and their tool invocations in ephemeral, kernel-enforced micro sandboxes with c… | 78 | 3830 | active |
| metorial/metorial Metorial is an open-source identity and access control plane for AI agents, providing 1200+ verified MCP integrations with centralized auth… | 64 | 3350 | active |
| ulisesbocchio/jasypt-spring-boot A Spring Boot integration of the Jasypt library that enables transparent encryption and decryption of property sources in Spring Boot appli… | 68 | 3088 | active |
| jenkinsci/configuration-as-code-plugin The Jenkins Configuration as Code (JCasC) plugin lets administrators configure Jenkins controllers and plugins via human-readable declarati… | 98 | 2795 | active |
| cloudflare/gokey gokey is a vaultless password manager written in Go that deterministically derives passwords and cryptographic keys on the fly from a maste… | 80 | 2431 | stable |
| 1backend/1backend 1Backend is an AI-native microservices platform written in Go that combines a framework, proxy, and runtime for building distributed applic… | 76 | 2342 | active |
| learnhouse/learnhouse LearnHouse is a next-generation open-source learning management system (LMS) for creating, sharing, and selling educational content. It com… | 99 | 2203 | active |
| nottelabs/notte Notte is a full-stack framework and cloud platform for building, deploying, and scaling AI web agents and browser automations. It combines … | 84 | 1997 | active |
| sniptt-official/ots OTS is a Go CLI tool for sharing end-to-end encrypted secrets (API keys, passwords, signing secrets) via one-time URLs. Secrets are destroy… | 36 | 1845 | active |
| stakpak/agent Stakpak is an open-source Rust CLI and autonomous agent that runs on your machines 24/7 to keep applications running, handling tasks like a… | 76 | 1756 | active |
| kimdre/doco-cd Doco-CD is a lightweight GitOps continuous deployment tool written in Go that automatically deploys and updates Docker Compose projects and… | 86 | 1640 | active |
| dyne/tomb Tomb is a minimalist command-line tool for GNU/Linux that creates and manages encrypted storage folders ('tombs') using dm-crypt and LUKS v… | 58 | 1581 | stable |
| fabro-sh/fabro Fabro is an open-source workflow orchestration engine that runs AI coding agents as version-controlled workflow graphs defined in Graphviz … | 77 | 1538 | active |
| webfactory/ssh-agent A GitHub Action that starts ssh-agent on the workflow runner, exports SSH_AUTH_SOCK, and loads one or more private SSH keys from repository… | 74 | 1482 | active |
| infrahq/infra Infra is an open-source authentication and access management service for servers, Kubernetes clusters, and databases. It provides identity-… | 66 | 1467 | active |
| lakekeeper/lakekeeper Lakekeeper is an Apache Iceberg REST Catalog implementation written in Rust that provides centralized access control, credential vending, a… | 91 | 1426 | active |
| getporter/porter Porter is a CNCF Sandbox CLI tool that packages applications, client tools, configuration, and deployment logic into CNAB-based installers … | 93 | 1423 | active |
page 1 / 2 next →