#secrets-management

lockenv

A free command-line tool that encrypts your .env secrets file so you can safely commit it to Git, with a pre-commit hook that catches accidental leaks before they happen.

AgentGate

An API gateway that lets AI agents call GitHub, Slack, or Google Workspace on a user's behalf without ever seeing the real credentials.

Leadcode

Terminal identity manager for freelancers juggling multiple clients, isolates GitHub, Claude, and API credentials per workspace.

Husk

A local-first security scanner that checks your machine for compromised packages, leaked secrets, and risky AI/MCP configs, no cloud, no login.

TruffleHog

A credential-scanning tool that searches Git repos, cloud storage and other sources for leaked secrets, then actively verifies each one against the real service so you know instantly which leaks are live.

Gitleaks

A fast, open-source scanner that detects hardcoded secrets — passwords, API keys, tokens — in git history, files or CI pipelines using customizable regex rules.

SOPS

A command-line editor for encrypting secrets inside YAML, JSON, ENV, INI or binary files — using AWS KMS, GCP KMS, Azure Key Vault, age or PGP — so encrypted config can be safely committed to git.

External Secrets Operator

Keeps your passwords and API keys in a proper secrets vault (Vault, AWS Secrets Manager, etc.) instead of loose in Kubernetes config, while still letting your apps read them the normal Kubernetes way — free, open source, and CNCF-backed.

TokenTimer

Open-source expiration tracker for certificates, API tokens, secrets and licenses, with alerts and automated renewal, self-hosted or cloud.

Defakto

A security tool for the passwords nobody thinks about — not the ones humans type, but the ones baked into scripts, servers and automated jobs that quietly run forever with the same credentials, which is exactly what attackers look for.

VulX

Scans AI-generated codebases for exposed keys, vulnerable dependencies, and authorization flaws, with plain-English fixes.

KeyLeak Detector

A free scanner that catches a mistake almost every web team makes eventually: accidentally leaving a real API key or database password visible in a website's code where anyone can copy it.

KeyHunter

A fast, free command-line tool that searches GitHub for leaked API keys and then actually tests each one to confirm whether it still works — instead of just flagging text that looks like a key.

KeySentry

A free tool that goes through a GitHub repository looking for accidentally-committed passwords, API keys, and sensitive files — the digital equivalent of checking your pockets before publishing.

Cycode

A security platform that scans your code, pipelines, and AI coding tools for vulnerabilities across your whole software supply chain, then tries to auto-fix what it finds.

Overslash

A middleman that sits between your AI agents and the online services they need to use (GitHub, Slack, AWS, and more), so the agent can act on your behalf without ever seeing your actual passwords or API keys.

Lemonade Password Manager

A password manager built by a developer, for developers — it stores your regular logins alongside the messier stuff, like .env files and API keys, that most password managers weren't really designed to hold.

Betterleaks

Free secrets scanner from Gitleaks' original creator: finds leaked API keys and passwords in code with far fewer false positives.

OneCLI

Open-source gateway that lets AI agents call APIs without ever seeing your real API keys — real secrets are injected transparently at the network level.

OpenBao

Community-governed, truly open-source secrets manager — a Linux Foundation fork of Vault, born when Vault went source-available.