notinferred / keypaste
A KeePass-compatible password and secrets manager for people who work with AI agents.
notinferred / keypaste
gitleaks / gitleaks
Scans git repos, files, and stdin for hardcoded secrets such as passwords, API keys, and tokens.
graygnatconsole / mcp-audit-tool
🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.
superdesigndev / treg
A registry and proxy that gives agents one base URL and token to call a catalog of third-party tool endpoints, billed per call.
aquasecurity / trivy
Open-source scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM data in containers, filesystems, git repos, VM images, and Kubernetes.
Spectrmachina / Ztrust
Zero-trust supply-chain security for open source: detects malicious & vulnerable dependencies, typosquats, leaked secrets and unsafe GitHub Actions — and pays independent researchers in shielded Zcash via a front-running-proof bounty protocol.
openbao / openbao
Open-source, community-governed fork of HashiCorp Vault for storing, encrypting, and distributing secrets, certificates, and keys.
Infisical / infisical
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
trufflesecurity / trufflehog
Scans repositories, filesystems, and chats for leaked credentials, then verifies whether each one is still live.
heyderekj / slinky
Slinky keeps secrets out of files. A native Mac app for API keys, .env variables and recovery codes.
betterleaks / betterleaks
Find leaked secrets everywhere.
getsops / sops
Simple and flexible tool for managing secrets
MaxHu-xuan / chat-archive-guard
Audit AI chat exports locally before sharing or migration. Find possible secrets, personal-data patterns, broken JSON/JSONL, SQLite issues, and scan gaps—without uploading the archive.
Infisical / agent-vault
A HTTP credential proxy and vault for AI agents like Claude Code, OpenClaw, Hermes, custom agents + harnesses, and more.
dmno-dev / varlock
AI-safe .env files: Schemas for agents, Secrets for humans.
hashgraph-online / hol-guard
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
strands-agents / box
Run AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential injection that keeps secrets outside the agent. Written in Rust. Supports macOS on Apple silicon, with Linux support planned.
golbin / rekey
Reissue an API key with one command and update it everywhere it is used (1Password + templates)
hashicorp / vault
A tool for secrets management, encryption as a service, and privileged access management
cachix / secretspec
A declarative interface for every secret provider.
bitnami / sealed-secrets
A Kubernetes controller and tool for one-way encrypted Secrets
drduh / YubiKey-Guide
Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.
stakater / Reloader
A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!
jhaals / yopass
Secure sharing of secrets, passwords and files
ghuntley / preflight
A local proxy that scans LLM requests and attachments for secrets before they reach the model.
nmatt0 / mithril
IoT static scanner for secrets, SBOM, CVEs and more.
cefege / harry-potter-2-chamber-of-secrets-pc
—
external-secrets / external-secrets
External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.
dotenvx / dotenvx
a secure dotenv—from the creator of `dotenv`
ryantm / agenix
age-encrypted secrets for NixOS and Home manager
onetimesecret / onetimesecret
Keep passwords and other sensitive information out of your chat logs and inboxes.
emberstack / kubernetes-reflector
Custom Kubernetes controller that can be used to replicate secrets, configmaps and certificates.
scito / extract_otp_secrets
Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.
fwdai / rowel
🔑 Local-first Secrets Manager
bank-vaults / bank-vaults
A Vault swiss-army knife: A CLI tool to init, unseal and configure Vault (auth methods, secret engines).
mongodb / kingfisher
Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.
sgasser / pasteguard
AI gets the context. Not your private data. Local-first privacy proxy for browser chat, AI APIs, and coding agents.
gitleaks / gitleaks-action
Protect your secrets using Gitleaks-Action
automic-vault / automic-vault
CLI security is broken. The packaging layer is where we fix it.
lukapiskorec / craftbot
CraftBot is an architect AI agent. It interprets design briefs, grounds its thinking in domain knowledge through ingesting documents, images and other references, and outputs Python code that procedurally defines a building design.
cachix / factorseal
Factorseal is a local secrets vault for Linux, macOS, and Windows.
hyzyn / dsh-plugin-kit
Plugin family for the DeepSeek Harness (DSH) Web GUI: a pnpm monorepo with a plugin template, dev kit, and one-command all-in-one bundle — Codegraph, env & secrets, MCP config, profiles, prompts, RSS digest, global search, and terminal panel.
AnuragRoy485 / Sleuth
Sleuth finds hardcoded secrets, API keys, tokens, private keys and high-entropy strings in your codebase fast, accurately, and with beautiful output.
QuesmaOrg / quesma-shipper
Collects AI coding-agent sessions from developer machines, scrubs secrets, encrypts with age, and uploads to your organisation's storage.
naveenautomationlabs / reporting-labs
One beautiful HTML test report for Playwright, Cypress and WebdriverIO, with Cucumber BDD. Shows what broke, who owns it and whether it is new. Plain-language errors, secrets masked, no server, no API keys.
edoardottt / cariddi
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
GitGuardian / ggshield
Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.
retspen / webvirtcloud
WebVirtCloud is virtualization web interface for admins and users
stacksimplify / aws-eks-kubernetes-masterclass
AWS EKS Kubernetes - Masterclass | DevOps, Microservices
OWASP / wrongsecrets
Vulnerable app with examples showing how to not use secrets
pypa / gh-action-pypi-publish
The blessed :octocat: GitHub Action, for publishing your :package: distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish
dotenvx / dotenv-expand
Expand variables already on your machine for use in your .env file.
meld-cp / obsidian-encrypt
Hide secrets in your Obsidian.md vault
etewiah / property_web_builder
Create a fully featured real estate website on Rails in minutes! ⛺
hashicorp / vault-secrets-operator
The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets natively from Kubernetes Secrets.
algolia / sup3rS3cretMes5age
Simple to use, simple to deploy, one time self destruct messaging service, with hashicorp vault as a backend
shospodarets / awesome-platform-engineering
Curated list of tools and resources for Platform Engineering
shea256 / secret-sharing
A system for securely splitting secrets with Shamir's Secret Sharing Scheme
CassiopeiaCode / CosyRedactGateway
Lightweight, stateless privacy gateway for LLM APIs — redact secrets before OpenAI/Anthropic upstreams and restore them transparently in SSE and tool calls.
GetSHIM / shim-cli
Local traffic visibility and privacy controls for coding agents. See what Claude Code, Codex and Copilot send to the model; mask secrets and personal data where the client allows it.