Bitnami Sealed Secrets is a Kubernetes controller and CLI tool that enables secure storage of encrypted Kubernetes Secrets in version control. The system consists of a cluster-side operator and a client-side CLI (`kubeseal`). The controller watches for custom `SealedSecret` custom resource definitions (CRDs) and decrypts them into regular Kubernetes `Secret` objects using asymmetric encryption (RSA-OAEP for key encapsulation and AES-256-GCM for data encryption). The CLI allows users to encrypt secrets using the controller's public certificate, validate sealed secrets, and re-encrypt them under different keys. The controller is deployed via a Helm chart or raw manifests, exposes Prometheus metrics, and provides HTTP endpoints for certificate retrieval, verification, and key rotation. The codebase is mature, well-tested with both unit and integration tests, and follows standard Kubernetes operator patterns (informers, work queues, status updates). It has a low technical drift, with recent dependency updates and active maintenance.
This repository is HashiCorp Vault, a production-grade secrets management platform that secures, stores, and controls access to tokens, passwords, certificates, API keys, and other sensitive data. In production, it operates as a distributed system with a Go server backend, a RESTful HTTP API, a CLI client, and an optional Ember.js web UI. The architecture is modular: core server logic (token store, identity store, policy engine, audit brokerage, replication) is extensible via a plugin SDK for custom authentication methods (LDAP, OIDC, Kubernetes, AWS, etc.) and secrets engines (PKI, transit encryption, dynamic database credentials, SSH, etc.). Primary entry points are the `main.go` binary, the `api/` Go client library, and the `command/` CLI package. Data flows involve client requests routed through the HTTP handler to the logical backend, which uses a physical storage abstraction (Raft, Consul, file, etc.) and optionally triggers external plugins over gRPC. The system relies heavily on cryptographic primitives, a lease/expiration manager, and an event pipeline for audit logging and telemetry.
ggshield is a production-grade CLI tool for detecting hardcoded secrets in code, git history, Docker images, PyPI packages, archives, and AI coding assistant interactions. It integrates with the GitGuardian API to scan for 500+ secret types, supporting both SaaS and self-hosted instances. The tool is designed for developers and CI/CD pipelines, offering git hooks (pre-commit, pre-push, pre-receive), a plugin system for extensibility, and AI agent hooks for Claude Code, Cursor, Copilot, Codex, Vibe, and Kiro. It also includes HMSL (Has My Secret Leaked) for checking secret exposure via cryptographic queries, honeytoken management, and machine-level setup for comprehensive security coverage. The architecture is a hybrid Python/Rust CLI built with Click. The Python codebase is organized into three layers: `cmd` (CLI commands), `core` (shared infrastructure like config, scan, cache, client, UI, plugin system), and `verticals` (domain logic for secret scanning, AI, HMSL, honeytokens). A Rust native component (`ggshield-hook`) handles AI hook scanning for performance, while a Rust dispatcher delegates non-hook commands to the Python launcher. The plugin system supports dynamic command registration with sigstore signature verification. Configuration is YAML-based with versioned schemas and global/local merging. Key entry points include `ggshield/__main__.py` (CLI root), `ggshield/cmd/secret/scan/` (scan subcommands), `ggshield/cmd/auth/login.py` (authentication), `ggshield/cmd/machine/setup.py` (one-shot protection), and `rust/dispatcher/src/main.rs` (Rust binary). External dependencies include the GitGuardian API (py-gitguardian), keyring for credential storage, and platform-specific utilities for notifications and machine ID derivation. The codebase demonstrates strong engineering practices with lazy command loading, output handler strategy pattern, cache abstractions, and comprehensive test coverage (80%+).
fnox is a production-grade secrets management CLI written in Rust. It resolves secrets from over 20 providers (encryption keys, cloud secret stores, password managers, hardware tokens) and injects them into subprocess environments, shell sessions, or a local TUI. The system uses a hierarchical, profile-based configuration model where secrets can be sourced from encrypted local files (age), cloud services (AWS, Azure, GCP, Vault), or third-party password managers (1Password, Bitwarden, Doppler, Proton Pass) with support for short-lived credential leases. It also provides a daemon for caching resolved secrets, an MCP server for AI agent integration, an HTTPS proxy that auto-injects credentials, and a secret scanning command for CI/CD pipelines.
Infisical is an open-source end-to-end encrypted secrets management platform used to centralize, secure, and sync secrets across teams and infrastructure. The codebase is structured as a multi-service application with a primary Node.js/TypeScript backend (REST API using Fastify) and a newer Go backend implementing core platform services (authentication, permission evaluation, KMS, audit logging, secret manager). The frontend is a React SPA built with Vite and TanStack Router. The system supports self-hosted (Docker, Helm) and cloud-deployed modes. It provides a rich set of capabilities including dynamic secrets, secret rotation, approval workflows, machine identity federation (AWS, Azure, GCP, Kubernetes, OIDC), PKI management (internal and external CAs), privileged access management (PAM), secret scanning, audit logging, and extensive integration syncs. The architecture follows a modular service-oriented pattern with clear separation of concerns, extensive use of dependency injection and factory patterns for extensibility.
Kapitan is a configuration-as-code CLI tool that renders infrastructure manifests (Kubernetes, Terraform, Docker, etc.) from a hierarchical YAML inventory and pluggable template engines (Jsonnet, Jinja2, Kadet, Helm, Kustomize, CUE). It manages secrets via references (GPG, cloud KMS, Vault, base64), fetches remote dependencies (Git, HTTP, OCI, Helm charts), and supports multiple inventory backends (Reclass, OmegaConf). The compilation pipeline is inventory-driven: targets define classes and parameters, which are deep-merged and interpolated, then passed to input-type compilers that produce deterministic output files. The architecture is modular—separate packages for inputs, inventory backends, secrets/references, and dependency management—all orchestrated by the `kapitan compile` CLI command. It is not a data research project; it is a production-grade infrastructure tool with a large test suite, CI/CD, and documented extension points.
enject is a security-focused CLI tool that prevents AI agents and other processes from reading secrets out of `.env` files. It stores secrets in an encrypted local store (AES-256-GCM with Argon2id key derivation) and injects them into subprocess environments at runtime. The `.env` file on disk contains only `en://` symbolic references, never plaintext values. The tool provides commands to initialize a store, add/update/list/delete secrets, import a plaintext `.env` file (encrypting all values and rewriting it as a template), rotate the master password, and run a subprocess with resolved environment variables. The architecture is a single Rust binary with a clean `Store` trait abstraction separating the encryption backend from command logic. The codebase demonstrates strong security practices: secrets never touch disk as plaintext, nonces are freshly generated on every write, key material is zeroized immediately after use, and unresolved references cause hard errors. It includes comprehensive unit tests and a CI pipeline with linting, formatting, and security auditing.
Hawk-Eye is a command-line application designed to scan various data sources for Personally Identifiable Information (PII) and secrets. It supports cloud storage (S3, GCS, Firebase), databases (MySQL, PostgreSQL, MongoDB, Redis), file systems, and collaboration platforms (Slack, Google Drive). The tool uses regex pattern matching and OCR to detect sensitive data in multiple file formats including images, PDFs, Office documents, and videos. The architecture is modular with a central dispatcher in main.py that routes commands to specific implementations in the commands/ directory. Shared functionality like file reading, OCR, and pattern matching is encapsulated in internals/system.py. This design allows easy extension to new data sources by adding new command modules. The tool is intended for security auditing and can be run standalone or integrated into scripts/CI/CD pipelines. Features include alert deduplication, severity-based reporting, and Slack/Jira integrations. Despite its comprehensive feature set, the tool maintains separation of concerns, making it maintainable and extensible. The use of third-party libraries for specific data sources keeps core logic focused on scanning and reporting.
This repository is the Go Cloud Development Kit (Go CDK), a multi-cloud SDK that provides portable, driver-based abstractions for common cloud services including blob storage, pub/sub messaging, document stores, runtime configuration variables, secrets management, and SQL databases (MySQL/PostgreSQL). The architecture follows a consistent pattern: each service defines a driver interface (e.g., `driver.Bucket`, `driver.Topic`, `driver.Collection`) and a portable wrapper that adds error handling, retries, OpenTelemetry instrumentation, and a URL-based opener multiplexer (`URLMux`). Concrete drivers exist for Google Cloud Platform (GCS, Pub/Sub, Firestore, Cloud SQL, KMS), Amazon Web Services (S3, SNS/SQS, DynamoDB, Parameter Store, Secrets Manager, KMS), Microsoft Azure (Blob Storage, Service Bus, Key Vault), and local/testing backends (in-memory, filesystem). The project also includes sample applications (guestbook, order processing, CLI tools), a Hugo-based documentation website, and extensive conformance test suites that use recorded HTTP/gRPC interactions for deterministic replay testing. The codebase demonstrates strong architectural patterns (driver abstraction, URL-based resource opening, batcher for pub/sub, codec for document stores) and comprehensive observability via OpenTelemetry. However, the code uses a non-standard Go dialect (e.g., `import` with quoted strings, `type` for interfaces, `var` for variables) that is not standard Go, which significantly limits tooling support, contributor familiarity, and reusability outside this project. Many drivers and internal utilities are tightly coupled to this custom language, making extraction difficult. The project appears to be in alpha status with several incomplete features, TODOs, and a large dependency surface across multiple cloud SDKs, indicating a high maintenance burden. The last commit date is in the future (2026-10-01), which is likely erroneous, but the overall activity suggests the project may have slowed or been abandoned.