# cachix/secretspec

A declarative interface for every secret provider.

Repository: https://github.com/cachix/secretspec
Canonical: https://ross.abutalabs.com/products/secretspec
Homepage: https://secretspec.dev
Language: Rust
License: Apache-2.0
License Family: permissive
Topics: secret-management, secrets
Last push: 2026-08-26T18:40:16+00:00

## Health v2 (maintenance only)
Score: 84/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 97, longevity 30
- inputs: {"age_days": 425, "days_push": 7, "days_rel": 21, "gap_med": 7, "n_releases_24m": 34}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1407, forks 84 (observed 2026-08-28T04:04:38.321586+00:00)

## What it is
SecretSpec is a declarative tool and library for defining the secrets an application needs in a secretspec.toml manifest and resolving them from any of 33 secret providers (Keychain, Vault, AWS Secrets Manager, 1Password, .env files, etc.) without hard-coding a provider. It ships as a Rust CLI plus SDKs for Rust, Python, Node.js, Go, Ruby, Haskell, and PHP.

## Use cases
- declare required secrets for a project in one manifest
- switch secret providers without changing application code
- run commands with secrets injected as environment variables
- verify all required secrets are set before CI or deployment
- load secrets into Rust, Python, Node, Go, Ruby, Haskell, or PHP apps
- replace scattered .env files with a provider-agnostic contract

## When to choose
- you want one declarative secret contract across development, CI, and production
- you need to support or migrate between many secret backends
- you want type-safe secret access in Rust or SDKs in multiple languages
- you want to avoid leaking secrets through ad-hoc environment variables

## When to avoid
- you only need a simple .env file loader with no provider abstraction
- you are locked into a single cloud provider's native secret tooling
- you need a full secrets server rather than a client-side resolver

## Facets
- artifact type: cli-tool
- maturity: active
- function: secrets-management, configuration-management, cli, developer-tools, sdk
- domain: security, developer-tools, self-hosted
- platform: windows, cross-platform, cli, rust, python, go, ruby, php, jvm
- tags: secrets, dotenv, declarative-configuration, secret-providers, environment-variables, keyring, vault, multi-language-sdk, devops, command-line, linux, macos, nodejs

## Member repositories
- cachix/secretspec (main) score 84

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:38.321586+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:38:38.176555+00:00, confidence not recorded.
  - readme: https://github.com/cachix/secretspec (fetched 2026-08-28T04:04:38.321586+00:00, sha 92998c14795d)
  - homepage: https://secretspec.dev (fetched 2026-08-29T11:52:23.438337+00:00, sha f7531e1d97fd)
  - registry_crates: https://crates.io/api/v1/crates/secretspec (fetched 2026-08-29T11:52:23.455934+00:00, sha 89109d0f42db)
  - site_page: https://secretspec.dev/quick-start (fetched 2026-08-29T11:52:23.442573+00:00, sha 89bf970d3c19)
  - site_page: https://secretspec.dev/sdk/rust (fetched 2026-08-29T11:52:23.444346+00:00, sha 8ce41f74b0d1)
  - site_page: https://secretspec.dev/sdk/python (fetched 2026-08-29T11:52:23.446308+00:00, sha 247f225c173d)
  - site_page: https://secretspec.dev/sdk/nodejs (fetched 2026-08-29T11:52:23.447900+00:00, sha 59e007a0b315)
  - site_page: https://secretspec.dev/sdk/go (fetched 2026-08-29T11:52:23.449464+00:00, sha 5839cdcd7b87)
  - site_page: https://secretspec.dev/sdk/ruby (fetched 2026-08-29T11:52:23.451056+00:00, sha 04681d02d7f3)
  - site_page: https://secretspec.dev/sdk/haskell (fetched 2026-08-29T11:52:23.452650+00:00, sha 6c920bf6290e)
- Data as of 2026-08-30T08:39:29.467469+00:00.