Secrets Manager vs VMware Secrets Manager
Secrets Manager
github.comVMware Secrets Manager
vsecm.comSide by side
| Figure | Secrets Manager | VMware Secrets Manager |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Secrets Management Tools | 8.3 (#7) | 8.0 (#15) |
| Encryption | The backend uses AES-256-GCM envelope encryption with a random data key per secret value, and the documentation says plaintext secret values are never stored in the database. | The production documentation says VSecM Safe encrypts secrets using age, or AES-256-GCM in FIPS-compliant environments. |
| License | The repository identifies its license as MIT. | The VSecM code is distributed under the BSD 2-Clause License. |
| Purpose | Secrets Manager is a self-hosted system for storing application secrets encrypted, managing them in a web UI, and injecting them into processes through a CLI. | VMware Secrets Manager is a Kubernetes-native key-value store for securely storing and dispatching secrets to cloud-native workloads. |
| Secret history | Secrets have versions that can be rolled back to earlier versions. | VSecM records creation and update timestamps and keeps version history for secrets. |
| Support | The repository directs vulnerability reports to a private GitHub security advisory and says not to disclose exploitable issues publicly. | The project directs users to its Slack workspace for questions and community help, and to GitHub Issues for bug reports, feature requests, or questions. |
Plans
In their own words
Secrets Manager
Secrets Manager is a free, open-source, self-hosted system for storing application secrets in encrypted form, managing them through a web interface, and injecting them into processes with a command-line tool. Users organize secrets by organization, project, and environment, import.env files, edit or reveal values, keep versions, roll back, and soft-delete entries. The `secrets run` command supplies environment secrets to a child process and its descendants without creating a.env file. Documented workflows cover Node.js, Python, npm, and Next.js; CI or deployment can use an API URL, token, and environment ID. User and service-account grants can be scoped to projects or environments, and revealing values requires explicit permission. AES-256-GCM envelope encryption uses a separate data key per value, while plaintext values are not stored in the database. Audit events include secret reveals, and values are withheld if audit writing fails. Docker Compose starts PostgreSQL, Redis, backend, and frontend; local Kubernetes manifests are also provided. A user-generated master key is mandatory and lost keys make secrets unrecoverable. The repository is MIT licensed.
VMware Secrets Manager
VMware Secrets Manager has no write-up on Specifiction yet; its figures are above.