HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
fugue
credstash
Python2015–2024
fugue / credstash

credstash

A little utility for managing credentials in the cloud

DevOps & CloudLibraries & SDKs
Explore on GitHubRead Hacker News discussions
14Distinct people
16Mentions
1Explicit recommenders
2.1KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A little utility for managing credentials in the cloud

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

We wrote Confidant in the beginning of 2015, so it's not a reinvention of sneaker. That said, sneaker is very similar in design, as is credstash:…

ryan_lane used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year16 dated mentions

Observed mentions: 2015-11-04 20:14:41 UTC to 2024-09-26 15:25:56 UTC.

02462015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 7 mentions; 0 submissions, 7 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC202
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC707
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC312
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC202
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101

What Hacker News says

16 sources
jumploops·Sep 26, 2024
The tl;dr here is: 1. Load secrets dynamically at runtime 2. Share internal creds via e.g. 1Pass Environment variables (+managing them with .env files) are a better start than putting keys in your codebase, but this can also be leaky/hard to keep up to date. Most cloud providers have some sort of secret management tool. Vault by Hashicorp is another solid option if you want to run your own. If you’re hosted on AWS, I’m personally a big fan of Credstash[0], which is basically a simple wrapper around DynamoDB+KMS. Cheaper than the AWS Secrets product and fast enough. I previously built a config that would take secrets from Credstash, env vars, and .env files (in that order). This offered the best of both worlds for local and remote deployments. [0]https://github.com/fugue/credstash
In Ask HN: What tools should I use to manage secrets from env files?
atmosx·Mar 7, 2023
Hello, At my current gig we're using doppler[^1] (no affiliation) for application secrets. We're using doppler with their kubernetes operator which supports auto-rotation on secrets. Secrets are set as "env variables". So far, doppler has not suffer big outages or we did not notice, because the operator will keep working even if their API is down - of course you won't get updates. Access control could be more _fine grained_ and they added secret auto-rotation option recently[^2]. We don't use that yet. I've been a happy 1Password user (no affiliation) and we use it company wide to share user secrets. 1Password support CI/CD integration IIRC, so in theory should cover most use cases. If you can pay for AWS Vault, the terraform integration comes out of the box. However if you're a small team running vault might be a daunting task and you're
Read the rest
inserting another SPoF. There are many open source application secrets tools that you could check out though. In the past I had great experience with credstash[^3]. Credstash is a really simple and secure open source solution that is based on AWS KMS, IAM and DynamoDB. Costs pennies to run for medium size deployments. Once you setup and document the way to use it, it's really easy. The downside is that as a tool is pretty _raw_ you have to build things like "secret generators", etc. But combined with a slack bot can be a really powerful, secure, cost-effective self-hosted solution that doesn't require maintenance (as opposed to solutions like Vault). If you have specific questions about any of the above tools feel free to drop an email. I'll happy to answer questions. [^1]: https://www.doppler.com/ [^2]: Auto-rotation is complicated because you need to integrate the auto-rotation with external tools yourself most of the times. There are Hashi-Vault modules for SQL DBs but not for Mailgun or CloudFlare for example. [^3]: https://github.com/fugue/credstash
In Ask HN: Secure and simple way for secret/credential management in a startup?
eropple·Jul 7, 2018
This write-up is solid - but man, this product looks questionable. 40 cents per secret per month? With Credstash[0] or a moral equivalent[1] you pay a buck for a KMS key and microcents for the data storage. RDS rotation is...fine, I guess, if you have an auditor who really wants that and can't write a scheduled job for the task (I've been using one with credstash so long it's just an automatic part of a new environment), but it's got me skeptical. Something AWS could do, and I'd be very interested in, is a hosted moral equivalent to Vault. Give me a daemon or something to run on an instance, allow me to IAM-gate temporary SSH credentials (and chuck it in CloudTrail) and temporary SQL databases, and that I'd pay for 'cause I really don't want to deal with Vault or HashiCorp. But AWS Secrets Manager, by itself, doesn't really present a good
Read the rest
reason-for-being to me. [0] - https://github.com/fugue/credstash [1] - https://github.com/codahale/sneaker
In How to manage any kind of secret with AWS Secrets Manager
avitzurel·Nov 7, 2017
I can give you one example where something like that happened. All of our services use credstash to store secrets. We use KMS in order to encrypt, decrypt the secrets and when the app loads we load all the secrets into memory. There was a major change to cryptography that caused credstash to break and in turn break a large set of our services. This PR [1] was submitted by one of the engineers to force the lower version to credstash and we opened the dependencies again to reload credstash on all services. The process to track it down and fix it took about an hour and all services were building correctly again. We make a very conscious choice to break those things in real time and deal with them rather than hiding them behind locked dependencies you simply never upgrade. [1] https://github.com/fugue/credstash/pull/174
In How we keep dependencies fresh across 45+ microservices
eropple·May 9, 2017
Not applicable for y'all, but for our AWS people, I'll cape up for Credstash[1] (or its moral equivalent, Sneaker[2], but I prefer the use of a Dynamo table to S3 for this). Uses IAM to ensure secret access and offers revisioning. Plus it's super easy to work with. My normal stack, using my own Auster[3] for orchestration, uses an offline, file-based secrets store (usually an encrypted USB key in production) for stuff like database root passwords that don't need to be online, then push database passwords into Credstash with encryption contexts (the KMS thing that makes IAM effective for this). My Chef cookbooks happily slurp in credstashed secrets via rcredstash, now that the PR to make it work with parameterized KMS keys has hit, and provisioning is very straightforward. (There are a lot of proper nouns in this paragraph, but the nice th
Read the rest
ing is that each component handles its own business and so there aren't many vertical concerns.) CI secret access isn't a thing in the systems I develop (unit tests don't need them, integration tests get a spun-up environment that provisions its own secrets), but you could provide access with a bog-standard token machine. [1] https://github.com/fugue/credstash [2] https://github.com/codahale/sneaker [3] https://github.com/eropple/auster
In Travis CI Security Advisory: Secured Environment Variables
dbarlett·Nov 20, 2016
I started with a manually-packaged Python function and credstash [1] to store credentials for non-AWS services. It gets invoked nightly by CloudWatch and has been bulletproof for months. I recently built a microservice [2] for Election Day with Flask and deployed it behind API Gateway with Zappa [3]. Lambda isn't for every use case, but for those it is, I'm bullish. [1] https://github.com/fugue/credstash [2] https://topics.arlingtonva.us/2016/11/voter-registration-sea... [3] https://www.zappa.io/
In New for AWS Lambda – Environment Variables and Serverless Application Model
josegonzalez·Oct 28, 2016
We initially looked around, and here are a few alternatives: - Azure Key Vault: https://azure.microsoft.com/en-us/services/key-vault/ - Blackbox: https://github.com/StackExchange/blackbox - CredStash: https://github.com/fugue/credstash - Lyft Confydant: https://github.com/lyft/confidant - Trousseau: https://github.com/oleiade/trousseau - Sneaker: https://github.com/codahale/sneaker Some of these didn't exist when we were first investigating proper secret management, while others didn't fit as well with our deployment strategy. We're using what works when it makes sense - Blackbox is used in some repos, for instance - but I'll be sure the next time we have an internal doc like this that we cover why we didn't choose a different set of tools. One thing we liked about Vault is that it built upon our usage of Consul a
Read the rest
nd the http interface for Vault meant it was simple to plug into how we build and deploy services. While I'm sure some of these other tools would have had as good workflows, our experience in administrating Consul made it easier for us to have confidence in Vault.
In Secret Management with Vault

Showing the 15 most recent of 16 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.