
SOPS
CLI加密 YAML、JSON、ENV、INI 等配置文件中的密钥值,支持 AWS / GCP / Azure KMS、age 与 PGP,让密钥可以安全地和代码一起存进 Git。CNCF 沙箱项目。
SOPS: Secrets OPerationS
SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY
formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP.
(demo <https://www.youtube.com/watch?v=YTEVyLXFiq0>_)
.. image:: https://i.imgur.com/X0TM5NI.gif
.. image:: https://pkg.go.dev/badge/github.com/getsops/sops/v3.svg :target: https://pkg.go.dev/github.com/getsops/sops/v3
Documentation
You can find the SOPS documentation on getsops.io <https://getsops.io/>_ under "Docs" <https://getsops.io/docs/>_.
Security
Please report any security issues privately using GitHub's advisory form <https://github.com/getsops/sops/security/advisories>_.
License
Mozilla Public License Version 2.0
Authors
SOPS was initially launched as a project at Mozilla in 2015 and has been
graciously donated to the CNCF as a Sandbox project in 2023, now under the
stewardship of a new group of maintainers <https://github.com/getsops/community/blob/main/MAINTAINERS.md>_.
The original authors of the project were:
- Adrian Utrilla @autrilla
- Julien Vehent @jvehent
Furthermore, the project has been carried for a long time by AJ Bahnken @ajvb,
and had not been possible without the contributions of numerous contributors <https://github.com/getsops/sops/graphs/contributors>_.
Credits
SOPS was inspired by hiera-eyaml <https://github.com/TomPoulton/hiera-eyaml>,
credstash <https://github.com/LuminalOSS/credstash>,
sneaker <https://github.com/codahale/sneaker>,
password store <http://www.passwordstore.org/> and too many years managing
PGP encrypted files by hand...
.. image:: docs/images/cncf-color-bg.svg :width: 400 :alt: CNCF Sandbox Project
We are a Cloud Native Computing Foundation <https://cncf.io>_ sandbox project.
相關資源

CC Safety Net
Plugin在工具调用执行前,拦截破坏性的 Git 与文件命令(如 git reset --hard、rm -rf)以及对 SSH 密钥、.env 等敏感文件的读写。它按命令语义解析,套一层 bash -c 也能识别。支持 Claude Code、Codex 等多种编码 CLI,需要 Node.js 18+。
kenryu42/cc-safety-net1.6k
Gitleaks
CLI检测 Git 仓库、目录文件与标准输入中硬编码的密码、API Key 和令牌,可配成 pre-commit 钩子或 GitHub Action 拦截密钥泄露。已宣布功能冻结、只发安全补丁,作者转向 Betterleaks。
gitleaks/gitleaks30k
TruffleHog
CLI在 Git、GitHub、S3、文件系统等来源中查找泄露的凭据,可识别 800 多种密钥类型,并登录对应服务验证密钥是否仍然有效,减少误报。
trufflesecurity/trufflehog28.5k
Trivy
CLI一站式安全扫描器:检查容器镜像、文件系统、Git 仓库与 Kubernetes 集群中的已知漏洞、IaC 错误配置、泄露密钥与软件许可证,并能生成 SBOM。Aqua Security 开源维护。
aquasecurity/trivy38.5k
Vault
CLIHashiCorp 的密钥管理系统:vault 命令行可读写密钥、按需签发数据库与云平台的动态凭据、加解密数据并管理租约与吊销。需要连接可用的 Vault 服务端。
hashicorp/vault36.4k
Checkov
CLI静态扫描 Terraform、CloudFormation、Kubernetes、Helm、Dockerfile 以及 CI 流水线配置里的安全和合规问题,内置上千条策略,能识别硬编码密钥,可输出 SARIF、JSON 等格式。由 Prisma Cloud 维护。
bridgecrewio/checkov9.1k