secr vs Secrets Manager

secr manages secrets and non-human identities for development teams, with a cloud service and a CLI that injects secrets directly into a process instead of requiring them in.env files. Teams can separate development, staging, and production secrets, compare or promote environments, and apply role-based permissions by environment. A scanner detects 20+ credential patterns and can install a pre-commit hook to block leaks before they reach git. AI agents can use scoped credentials, secret allowlists, and conditional access policies. Integrations include development tools, approval channels, cloud platforms, and SDKs for Node.js, Python, and Go. The Free plan costs nothing and includes 3 projects, 100 secrets, 1 AI agent, and a 7-day audit log. Pro is $6 a month and Team is $14 a month, each with a 14-day trial. Enterprise pricing is custom. The security page calls its SOC 2 control mapping a self-assessment; formal Type II certification is on its roadmap.

Secrets Manager is a free, open-source, self-hosted system for storing application secrets in encrypted form, managing them through a web interface, and injecting them into processes with a command-line tool. Users organize secrets by organization, project, and environment, import.env files, edit or reveal values, keep versions, roll back, and soft-delete entries. The `secrets run` command supplies environment secrets to a child process and its descendants without creating a.env file. Documented workflows cover Node.js, Python, npm, and Next.js; CI or deployment can use an API URL, token, and environment ID. User and service-account grants can be scoped to projects or environments, and revealing values requires explicit permission. AES-256-GCM envelope encryption uses a separate data key per value, while plaintext values are not stored in the database. Audit events include secret reveals, and values are withheld if audit writing fails. Docker Compose starts PostgreSQL, Redis, backend, and frontend; local Kubernetes manifests are also provided. A user-generated master key is mandatory and lost keys make secrets unrecoverable. The repository is MIT licensed.