SOPS
CLIEncrypts secret values in YAML, JSON, ENV and INI config files using AWS, GCP or Azure KMS, age or PGP, so secrets can be safely committed to Git alongside code. A CNCF sandbox project.
SOPS: Secrets OPerationS
SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY
formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP.
(demo <https://www.youtube.com/watch?v=YTEVyLXFiq0>_)
.. image:: https://i.imgur.com/X0TM5NI.gif
.. image:: https://pkg.go.dev/badge/github.com/getsops/sops/v3.svg :target: https://pkg.go.dev/github.com/getsops/sops/v3
Documentation
You can find the SOPS documentation on getsops.io <https://getsops.io/>_ under "Docs" <https://getsops.io/docs/>_.
Security
Please report any security issues privately using GitHub's advisory form <https://github.com/getsops/sops/security/advisories>_.
License
Mozilla Public License Version 2.0
Authors
SOPS was initially launched as a project at Mozilla in 2015 and has been
graciously donated to the CNCF as a Sandbox project in 2023, now under the
stewardship of a new group of maintainers <https://github.com/getsops/community/blob/main/MAINTAINERS.md>_.
The original authors of the project were:
- Adrian Utrilla @autrilla
- Julien Vehent @jvehent
Furthermore, the project has been carried for a long time by AJ Bahnken @ajvb,
and had not been possible without the contributions of numerous contributors <https://github.com/getsops/sops/graphs/contributors>_.
Credits
SOPS was inspired by hiera-eyaml <https://github.com/TomPoulton/hiera-eyaml>,
credstash <https://github.com/LuminalOSS/credstash>,
sneaker <https://github.com/codahale/sneaker>,
password store <http://www.passwordstore.org/> and too many years managing
PGP encrypted files by hand...
.. image:: docs/images/cncf-color-bg.svg :width: 400 :alt: CNCF Sandbox Project
We are a Cloud Native Computing Foundation <https://cncf.io>_ sandbox project.
Ähnliche Ressourcen
CC Safety Net
PluginBefore tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+.
kenryu42/cc-safety-net1.6k
Gitleaks
CLIDetects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks.
gitleaks/gitleaks30k
TruffleHog
CLIFinds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives.
trufflesecurity/trufflehog28.5k
Trivy
CLIAll-in-one security scanner for container images, filesystems, Git repos and Kubernetes clusters: finds known vulnerabilities, IaC misconfigurations, leaked secrets and software licenses, and generates SBOMs. Open source, maintained by Aqua Security.
aquasecurity/trivy38.5k
Vault
CLIHashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server.
hashicorp/vault36.4k
Checkov
CLIStatic scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.
bridgecrewio/checkov9.1k