cachix/secretspec

Health v2 · maintenance only

Adoption not part of the score

1407 stars · 84 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SecretSpec is a declarative tool and library for defining the secrets an application needs in a secretspec.toml manifest and resolving them from any of 33 secret providers (Keychain, Vault, AWS Secrets Manager, 1Password, .env files, etc.) without hard-coding a provider. It ships as a Rust CLI plus SDKs for Rust, Python, Node.js, Go, Ruby, Haskell, and PHP.

Use cases

• declare required secrets for a project in one manifest
• switch secret providers without changing application code
• run commands with secrets injected as environment variables
• verify all required secrets are set before CI or deployment
• load secrets into Rust, Python, Node, Go, Ruby, Haskell, or PHP apps
• replace scattered .env files with a provider-agnostic contract

When to choose

• you want one declarative secret contract across development, CI, and production
• you need to support or migrate between many secret backends
• you want type-safe secret access in Rust or SDKs in multiple languages
• you want to avoid leaking secrets through ad-hoc environment variables

When to avoid

• you only need a simple .env file loader with no provider abstraction
• you are locked into a single cloud provider's native secret tooling
• you need a full secrets server rather than a client-side resolver

Facets

cli-tool · maturity active

secrets-management configuration-management cli developer-tools sdk security developer-tools self-hosted windows cross-platform cli rust python go ruby php jvm secrets dotenv declarative-configuration secret-providers environment-variables keyring vault multi-language-sdk devops command-line linux macos nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cachix/secretspec")