git-secret — Encrypted Secrets Inside a Git Repository

★ 4.1K

git-secret is an open-source bash tool that stores sensitive files inside a git repository in encrypted form. Teams reach for it when API keys, passwords and config files need to live next to the code but never in plain text, when only a small group of colleagues should be able to read those secrets, or when someone leaves the team and their access has to be revoked quickly. Files are encrypted with the public keys of permitted users through GPG, and only the holder of a matching secret key can decrypt them. To revoke access, you remove the person's key from the repository keyring with git secret removeperson and re-encrypt the files; if they could have copied the secrets earlier, the secrets themselves should be rotated too. It requires bash 3.2.57 or newer, gawk, git, gpg (GnuPG 1.4 to 2.x) and sha256sum, and installs via brew, apt, yum or make. The mode that encrypts only modified files relies on SHA-256 checksums, so the authors recommend padding short secrets with random data or avoiding the -m flag. It is MIT-licensed.