secrets
ActiveHardware-Backed Secrets for Authorized Processes
A hardware-backed secrets manager that replaces plaintext secrets in configuration files with an encrypted store and a daemon-mediated access workflow. On macOS, access is gated by user presence and caller code-signature verification, so authorized processes can request secrets with the user's approval.
Security guarantees depend on the platform and key custodian. See the repository's security documentation for the threat model and limitations.
Key Features
- •Encrypted, per-file secret storage managed by secretsd
- •Hardware-backed key custodians including Secure Enclave, Keychain, and YubiKey
- •User-presence checks and caller code-signature verification on macOS
- •CLI for storing, retrieving, listing, and deleting secrets
- •Inject selected secrets into a child process with secrets run