#secrets-management

TruffleHogNew

A credential-scanning tool that searches Git repos, cloud storage and other sources for leaked secrets, then actively verifies each one against the real service so you know instantly which leaks are live.

GitleaksNew

A fast, open-source scanner that detects hardcoded secrets — passwords, API keys, tokens — in git history, files or CI pipelines using customizable regex rules.

SOPSNew

A command-line editor for encrypting secrets inside YAML, JSON, ENV, INI or binary files — using AWS KMS, GCP KMS, Azure Key Vault, age or PGP — so encrypted config can be safely committed to git.

External Secrets OperatorNew

Keeps your passwords and API keys in a proper secrets vault (Vault, AWS Secrets Manager, etc.) instead of loose in Kubernetes config, while still letting your apps read them the normal Kubernetes way — free, open source, and CNCF-backed.

TokenTimerNew

Open-source expiration tracker for certificates, API tokens, secrets and licenses, with alerts and automated renewal, self-hosted or cloud.

DefaktoNew

A security tool for the passwords nobody thinks about — not the ones humans type, but the ones baked into scripts, servers and automated jobs that quietly run forever with the same credentials, which is exactly what attackers look for.

VulXNew

Scans AI-generated codebases for exposed keys, vulnerable dependencies, and authorization flaws, with plain-English fixes.

Offsend

A gitignore-style rulebook for AI coding assistants: you list which files and secrets should never be shown to Cursor, Claude Code, or Windsurf, and Offsend blocks them locally before the agent ever sees your repo.

KeyLeak Detector

A free scanner that catches a mistake almost every web team makes eventually: accidentally leaving a real API key or database password visible in a website's code where anyone can copy it.

KeyHunter

A fast, free command-line tool that searches GitHub for leaked API keys and then actually tests each one to confirm whether it still works — instead of just flagging text that looks like a key.

KeySentry

A free tool that goes through a GitHub repository looking for accidentally-committed passwords, API keys, and sensitive files — the digital equivalent of checking your pockets before publishing.

Otterize

A Kubernetes tool that lets developers declare which service needs to talk to which — in plain terms, like "this service needs to read that database" — and generates the actual security policies (network rules, IAM, Kafka ACLs) automatically instead of so

InPrivy

A way to send a password or API key to someone without leaving it sitting in an email or chat forever — you get a link that self-destructs after it's opened once.

Cycode

A security platform that scans your code, pipelines, and AI coding tools for vulnerabilities across your whole software supply chain, then tries to auto-fix what it finds.

Overslash

A middleman that sits between your AI agents and the online services they need to use (GitHub, Slack, AWS, and more), so the agent can act on your behalf without ever seeing your actual passwords or API keys.

API Stronghold

Instead of handing your AI agents and scripts your real API keys (which is dangerous if they get compromised), API Stronghold gives them temporary, limited-use tokens that expire in minutes and can't be traced back to your actual credentials.

Lemonade Password Manager

A password manager built by a developer, for developers — it stores your regular logins alongside the messier stuff, like .env files and API keys, that most password managers weren't really designed to hold.

Betterleaks

Free secrets scanner from Gitleaks' original creator: finds leaked API keys and passwords in code with far fewer false positives.

OneCLI

Open-source gateway that lets AI agents call APIs without ever seeing your real API keys — real secrets are injected transparently at the network level.

OpenBao

Community-governed, truly open-source secrets manager — a Linux Foundation fork of Vault, born when Vault went source-available.