Secrets Manager vs Stashbase

Secrets Manager is a free, open-source, self-hosted system for storing application secrets in encrypted form, managing them through a web interface, and injecting them into processes with a command-line tool. Users organize secrets by organization, project, and environment, import.env files, edit or reveal values, keep versions, roll back, and soft-delete entries. The `secrets run` command supplies environment secrets to a child process and its descendants without creating a.env file. Documented workflows cover Node.js, Python, npm, and Next.js; CI or deployment can use an API URL, token, and environment ID. User and service-account grants can be scoped to projects or environments, and revealing values requires explicit permission. AES-256-GCM envelope encryption uses a separate data key per value, while plaintext values are not stored in the database. Audit events include secret reveals, and values are withheld if audit writing fails. Docker Compose starts PostgreSQL, Redis, backend, and frontend; local Kubernetes manifests are also provided. A user-generated master key is mandatory and lost keys make secrets unrecoverable. The repository is MIT licensed.

Stashbase manages application secrets across projects and environments, with scoped controls over how developers, services, and coding agents use credentials and other resources. Coding agents can run in native or Docker sandboxes with governed access to credentials, network, files, and MCP tools. The Agent Proxy keeps raw secret values outside the agent process, and policies can cover credentials, API requests, MCP tools, files, commands, and dependencies. Repository and secret scanning workflows help identify exposed or hard-coded secrets. Interfaces include a dashboard, CLI, SDKs, REST API, Agent Proxy, and MCP server. Documentation describes integrations for AWS Secrets Manager, Google Cloud Secret Manager, and Vercel. The security page states that Stashbase uses AES-256 multi-layer encryption and workspace isolation, and encrypts traffic in transit. It also supports secret rotation, CI/CD injection, and audit logs. Its local quickstart can run a file policy without an account, API key, or secrets; the desktop quickstart is for macOS or Linux. A free plan is listed, while paid pricing is noted from $25/user/mo.