Skip to content
SPECIFICTION
Get listed

Secrets Manager

github.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.3 #7 of 46 in Secrets Management Tools

What it is

Secrets Manager is a free, open-source, self-hosted system for storing application secrets in encrypted form, managing them through a web interface, and injecting them into processes with a command-line tool. Users organize secrets by organization, project, and environment, import.env files, edit or reveal values, keep versions, roll back, and soft-delete entries. The `secrets run` command supplies environment secrets to a child process and its descendants without creating a.env file. Documented workflows cover Node.js, Python, npm, and Next.js; CI or deployment can use an API URL, token, and environment ID. User and service-account grants can be scoped to projects or environments, and revealing values requires explicit permission. AES-256-GCM envelope encryption uses a separate data key per value, while plaintext values are not stored in the database. Audit events include secret reveals, and values are withheld if audit writing fails. Docker Compose starts PostgreSQL, Redis, backend, and frontend; local Kubernetes manifests are also provided. A user-generated master key is mandatory and lost keys make secrets unrecoverable. The repository is MIT licensed.

Spec sheet

Purpose
Secrets Manager is a self-hosted system for storing application secrets encrypted, managing them in a web UI, and injecting them into processes through a CLI.Read 11 Oct 2026 · github.com
Platforms
The CLI documentation includes Windows PowerShell and macOS/Linux usage; the product also provides a browser UI and API.Read 11 Oct 2026 · github.com
Deployment
Docker Compose starts PostgreSQL, Redis, the backend, and frontend; local Kubernetes manifests are also provided for a kind cluster.Read 11 Oct 2026 · github.com
Integrations
The documented CLI workflow uses Node.js and shows app commands for Node.js, Python, npm, and Next.js; CI or deployment can use `SECRETS_API_URL`, `SECRETS_TOKEN`, and `ENVIRONMENT_ID`.Read 11 Oct 2026 · github.com
Support
The repository directs vulnerability reports to a private GitHub security advisory and says not to disclose exploitable issues publicly.Read 11 Oct 2026 · github.com
License
The repository identifies its license as MIT.Read 11 Oct 2026 · github.com
Access controls
Access can be granted to users and service accounts at project or environment scope, and revealing secret values requires an explicit grant.Read 11 Oct 2026 · github.com
Audit
The system records audit events including secret reveals, and documents that secret values are not returned if the required audit write fails.Read 11 Oct 2026 · github.com
CLI
The `secrets run` command fetches environment secrets and supplies them to a child process without creating a `.env` file.Read 11 Oct 2026 · github.com
CLI injection
The `secrets run` CLI command injects an environment’s secrets into a child process and its children without creating a .env file.Read 11 Oct 2026 · github.com
Deployment requirements
The quickstart requires Docker and Docker Compose, plus Node 20 or later for the CLI step.Read 11 Oct 2026 · github.com
Encryption
The backend uses AES-256-GCM envelope encryption with a random data key per secret value, and the documentation says plaintext secret values are never stored in the database.Read 11 Oct 2026 · github.com
Important security notice
The maker says a real master key was published in the repository before 2026-07-26 and advises treating secrets encrypted with it as disclosed and following its recovery steps.Read 11 Oct 2026 · github.com
Key requirement
A user-generated master key is required before startup; losing it makes stored secrets unrecoverable.Read 11 Oct 2026 · github.com
Master key requirement
A user-generated master encryption key is required before startup, and the maker warns that losing it makes stored secrets unrecoverable.Read 11 Oct 2026 · github.com
MVP audience
The project describes itself as an open-source MVP focused on a clean first-run experience for a single developer, with multi-user organizations, roles, and grants also available.Read 11 Oct 2026 · github.com
Organization
Users can create organizations, projects, and environments to organize secrets for team projects.Read 11 Oct 2026 · github.com
Platform support
The maker documents CLI support for Windows PowerShell and Command Prompt, and gives macOS/Linux command examples.Read 11 Oct 2026 · github.com
Product status
The project’s README documents self-hosted Docker Compose deployment and does not list hosted plans or prices.Read 11 Oct 2026 · github.com
Secret history
Secrets have versions that can be rolled back to earlier versions.Read 11 Oct 2026 · github.com
Secret management
The UI supports importing .env files, editing and revealing secrets, keeping versions, rolling back, and soft-deleting secrets.Read 11 Oct 2026 · github.com
Security incident
The maker says a real master key appeared in repository history before 2026-07-26 and warns that any key obtained from the repository before that date must never be used.Read 11 Oct 2026 · github.com
Support channel
The security policy asks users to report exploitable vulnerabilities through a private GitHub security advisory rather than a public issue.Read 11 Oct 2026 · github.com

Plans and prices

Open-source self-hosted Free MVP focused on a single developer; requires Docker Compose and Node 20+ for the CLI Read 11 Oct 2026 · github.com

Every Secrets Manager plan and price →

Strong points and limits

Strong points

  • Free MIT-licensed open-source project
  • Encrypted storage with AES-256-GCM
  • Versioning, rollback, and soft deletion
  • CLI injection without creating .env files
  • Audit events and scoped access grants

Limits

  • Self-hosted deployment requires Docker Compose
  • CLI setup requires Node 20 or later
  • Lost master key makes secrets unrecoverable
  • A repository master key exposure requires recovery steps

Who it suits

It suits developers and teams wanting an open-source, self-hosted secrets store with CI/CD injection, Kubernetes deployment options, versioning, and audit controls. The documented MVP emphasizes a single developer while supporting organizations and grants.

Verdict

Secrets Manager offers a broad self-hosted workflow for encrypted storage, controlled access, auditing, and process injection. Its master-key responsibility and disclosed repository-key incident are critical operational considerations.

Where Specifiction places it

Alternatives to Secrets ManagerAll alternatives →