# Tools > Every listed resource, editors’ picks first. The filters below can be combined. - Search: append `?q=` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README. - Filter by type: append `?type=` to the URL. - Filter by profession: append `?profession=` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions - Filter by tag: append `?tag=` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags Resources for Full-stack / Indie or DevOps / SRE or ML / AI, Tagged `secrets-management`: 14 items. > - Full-stack / Indie: General software work: coding-agent workflows, code review, debugging and Git collaboration. > - DevOps / SRE: Deployment, monitoring, cloud resources and reliability. > - ML / AI: Model training, evaluation and LLM application development. - [mkcert](https://hebbmind.com/cli/mkcert.md): [CLI] Creates a local CA with one command and issues development HTTPS certificates trusted by your system and browsers, for localhost, IPs and wildcard domains, with no extra configuration. Run mkcert -install once first to add the root certificate to the trust store. - [Vault](https://hebbmind.com/cli/vault.md): [CLI] HashiCorp's secrets management system: the vault CLI reads and writes secrets, issues dynamic database and cloud credentials on demand, encrypts and decrypts data, and manages leases and revocation. Needs a reachable Vault server. - [Gitleaks](https://hebbmind.com/cli/gitleaks.md): [CLI] Detects hardcoded passwords, API keys and tokens in Git repos, files and stdin, and can run as a pre-commit hook or GitHub Action to block leaks. Now feature-frozen with security fixes only, as the author has moved on to Betterleaks. - [TruffleHog](https://hebbmind.com/cli/trufflehog.md): [CLI] Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives. - [SOPS](https://hebbmind.com/cli/sops.md): [CLI] Encrypts secret values in YAML, JSON, ENV and INI config files using AWS, GCP or Azure KMS, age or PGP, so secrets can be safely committed to Git alongside code. A CNCF sandbox project. - [direnv](https://hebbmind.com/cli/direnv.md): [CLI] Loads and unloads environment variables per directory: reads .envrc (and optionally .env) when you enter a project and restores the environment when you leave, so configs and secrets do not leak between projects. Hook it into bash, zsh, fish or another shell first. - [CC Safety Net](https://hebbmind.com/plugin/cc-safety-net.md): [Plugin] Before tool calls run, blocks destructive Git and file commands (git reset --hard, rm -rf) and access to sensitive files like SSH keys and .env. Parses command semantics, so bash -c wrappers are caught too. Works with Claude Code, Codex and other coding CLIs; needs Node.js 18+. - [Docker MCP Gateway](https://hebbmind.com/mcp/mcp-gateway.md): [MCP] Docker's official MCP gateway (the docker mcp CLI plugin): runs servers from the Docker MCP Catalog in isolated containers, manages secrets, OAuth and tool toggles centrally, and gives multiple clients one endpoint. Built into Docker Desktop 4.59+; Docker CE and other setups must build the plugin. - [SonarQube](https://hebbmind.com/plugin/sonarqube-agent-plugins.md): [Plugin] Sonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker. - [Pulumi Agent Skills](https://hebbmind.com/plugin/pulumi-agent-skills.md): [Plugin] Pulumi's official plugin marketplace: write infrastructure as code in TypeScript, Python, Go and more, migrate from Terraform, CDK, CloudFormation or ARM, and manage ESC secrets and config. Works with both Claude Code and Codex. - [Pulumi Agent Skills](https://hebbmind.com/skill/pulumi-agent-skills.md): [Skill] Pulumi's official skills: Pulumi program best practices, components and the Automation API, ESC secrets and config, debugging failed pulumi up runs, and migrating from Terraform, CDK, CloudFormation or ARM to Pulumi. - [Vault MCP Server](https://hebbmind.com/mcp/vault-mcp-server.md): [MCP] HashiCorp's official MCP: lets agents manage Vault mounts, read and write KV secrets, enable PKI, create issuers and roles, and issue certificates. Needs a reachable Vault server and token; HashiCorp recommends using it only in trusted local environments. - [GitGuardian MCP Server](https://hebbmind.com/mcp/ggmcp.md): [MCP] GitGuardian's official MCP: scans code for leaked secrets with 500+ detectors, and lets agents triage and remediate incidents, generate honeytokens and open fix PRs. Needs a GitGuardian account; the hosted endpoint with OAuth sign-in is recommended. - [Semgrep Guardian](https://hebbmind.com/plugin/semgrep-plugin.md): [Plugin] Semgrep's official MCP server plus hooks: every file the agent writes is scanned with Semgrep Code, Supply Chain and Secrets for vulnerabilities, malicious dependencies and hardcoded secrets; the agent rewrites until clean or you dismiss findings. Requires a Semgrep login.