Repolode
Submit
sobolevn

sobolevn/git-secret

A bash tool that stores private files encrypted with GPG inside a git repository, shared with trusted users by their public keys.

View on GitHubWebsite
Stars
4,056
Forks
213
Open issues
153
Last commit
21 days ago

What is it?

git-secret keeps private data such as passwords, keys, or config files inside a git repository in encrypted form. Files are encrypted with the public keys of the users you permit, so those users can decrypt them with their own GPG secret keys. Access is managed through git-secret commands rather than by manually handling GPG encryption.

When a team member loses access, you remove their key from the repository keyring with the removeperson command and re-encrypt the files. The project notes that if the removed user may already have copied the secrets, the secrets themselves should also be changed.

The tool is written in Bash and needs bash, gawk, git, gpg and sha256sum (or shasum on FreeBSD and macOS). It can be installed via Homebrew, apt, yum, or make.

Key features

  • 01Encrypts files with GPG using each permitted user's public key.
  • 02Adds and removes users by managing the repository keyring.
  • 03Re-encrypts secrets after access changes with a single command.
  • 04Stores encrypted files in git so they are versioned with the code.
  • 05Installable through Homebrew, apt, yum, or make.

Use cases

  • Sharing database passwords or API keys with a small team through a repository.
  • Keeping encrypted configuration files versioned alongside application code.
  • Revoking a former collaborator's access without rotating every secret, when they have not copied them.

Quick start

  1. 1

    Install via Homebrew

    brew install git-secret

Things to know

  • Requires external tools such as bash, gawk, git and gpg to be installed.
  • Revoking access does not remove already-copied secrets, so secrets may need to be changed.

Topics

#encryption#git#gpg#secret-management#bash#security#git-addons#git-secret

FAQ

What is git-secret?
A bash tool that stores private files encrypted with GPG inside a git repository, shared with trusted users by their public keys. git-secret keeps private data such as passwords, keys, or config files inside a git repository in encrypted form. Files are encrypted with the public keys of the users you permit, so those users can decrypt them with their own GPG secret keys. Access is managed through git-secret commands rather than by manually handling GPG encryption.
Is git-secret free to use? What license does it have?
git-secret is open source under the MIT license. Check the license terms before using it in commercial products.
Is git-secret still maintained?
Actively maintained. The last commit to git-secret was on Sep 28, 2026.
What can I use git-secret for?
Sharing database passwords or API keys with a small team through a repository. Keeping encrypted configuration files versioned alongside application code. Revoking a former collaborator's access without rotating every secret, when they have not copied them.
How do I install git-secret?
Install via Homebrew: brew install git-secret
Where can I get git-secret?
The source code and installation instructions are on GitHub: https://github.com/sobolevn/git-secret

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects