#secrets

The monorepository for the Friends Of Adonis packages

AWS Secrets Manager Configuration Provider

The blessed :octocat: GitHub Action, for publishing your :package: distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish

Shared Gitleaks configuration for Nick2bad4u projects.

Expand variables already on your machine for use in your .env file.

Detect and redact secrets in key-value pairs, dicts, and environment variables. Library and CLI.

Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free and local-first.

Type-safe config for TypeScript. Read typed values from any source, .env files, process.env, Workers bindings, browser bundles, or any object you bind. Zero runtime deps, one API across Node, Bun, Deno, Workers, and the browser.

A modern git based age-encrypted secrets manager for teams.

Drop-in fakes of Azure .NET SDKs to make your tests runnable locally, without real infrastructure, blazing-fast and reliable.

Per-project secrets in local KeePassXC vaults, injected into commands without ever printing them. Agent-safe: PreToolUse guard hook + read-only MCP server. Single Go binary.

High-performance open-source secret scanner — detect, verify & report leaked API keys, tokens & credentials in code, Git history, container images, and the cloud.

Runs Secretlint from ESLint and adds Secretlint-specific config authoring rules.

Shared TypeScript contracts for app manifests, UI schemas, auth, database, infra, and provider adapters.

Your agent machine needs your logins. Pantry ships them sealed. Opt-in AES-256-GCM browser session and secret sync for AI agent hosts.

SunLit Security Libraries: Rust security crates for OWASP-aligned services

Configurable tool bundle for AI coding agents — use via MCP server, CLI, or agent skills. npm wrapper for the Rust binary.

Local credential control for AI coding agents.

A dependency-free, no_std Rust crate for secure in-memory secret handling, constant-time checks, and automated clear-on-drop zeroization.

Safe-by-default script sandbox in Go. Runs programs under default-deny OS isolation on Linux (bubblewrap + Landlock + seccomp): credential shielding, per-host network allowlisting via a host-side CONNECT proxy, resource limits, and a profile-then-grant consent flow. macOS support is planned.

The AWS Secrets Manager .NET caching client enables in-process caching of secrets for .NET applications.

Redact sensitive information from strings, arrays and objects.

Streaming privacy for LLM apps: pii-leak-benchmark (does your gateway leak PII in streams?), chunk-invariance (one-line test for split-boundary leaks), mcp-ssrf-check, and a self-hosted redacting gateway.

The Ultimate tool for managing and securing the Environment Variables.

🔐 Modern client for the HashiCorp's Vault API