HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
getsops
sops
Go2015–2026
getsops / sops

sops

Simple and flexible tool for managing secrets

Security & PrivacyDevOps & Cloud
Explore on GitHubRead Hacker News discussions
81Distinct people
95Mentions
2Explicit recommenders
23.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Simple and flexible tool for managing secrets

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

I recommend against with using secrets managers as opposed to config files for storing configuration. Ideally, your configuration is versioned and code-reviewed. Config files…

xvector used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:28:18 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year95 dated mentions

Observed mentions: 2015-11-01 16:14:34 UTC to 2026-08-28 16:57:09 UTC.

0510152015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 5 mentions; 2 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 14 mentions; 2 submissions, 12 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 9 mentions; 2 submissions, 7 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 15 mentions; 1 submissions, 14 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 16 mentions; 0 submissions, 16 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 9 mentions; 2 submissions, 7 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC422
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC413
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC523
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC615
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC14212
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC413
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC927
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC15114
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC16016
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC927
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC808

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
SOPS: Secrets OPerationS SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP. (demo) Documentation You can find the SOPS documentation on getsops.io under "Docs". Security Please report any security issues privately using GitHub's advisory form. License Mozilla Public License Version 2.0 Authors SOPS was initially launched as a project at Mozilla in 2015 and has been graciously donated to the CNCF as a Sandbox project in 2023, now under the stewardship of a new group of maintainers. The original authors of the project were: Adrian Utrilla @autrilla Julien Vehent @jvehent Furthermore, the project has been carried for a long time by AJ Bahnken @ajvb, and had not been possible without the contributions of numerous contributors. Credits SOPS was inspired by hiera-eyaml, credstash, sneaker, password store and too many years managing PGP encrypted files by hand... We are a Cloud Native Computing Foundation sandbox project.
Read the full README on GitHub

What Hacker News says

14 sources
thinkmassive·Dec 8, 2020
Anyone saving encrypted secrets in git will probably find it helpful to enable cleartext diffs: https://github.com/mozilla/sops#48showing-diffs-in-cleartext... If you have many secrets you'll probably still end up breaking them out into different files to minimize conflicts between multiple in-progress branches. A good place to start is keeping a secrets file per environment+service: - sops-dev-mywebapp.yml - sops-dev-mydb.yml - sops-prod-mywebapp.yml - sops-prod-mydb.yml
In Simple and flexible tool for managing secrets
avh02·Dec 8, 2020
worked with this at a previous job - pro tip if you're doing anything with KMS (and are doing a lot of role assumption, etc), set AWS_SDK_LOAD_CONFIG=1 https://github.com/mozilla/sops/issues/471#issuecomment-5036... (and i'm sure countless other references) Generally found that setting that env var with anything mildly complicated (in go!) in terms of AWS roles helps. Other libraries/clis/etc (in other languages) tend to transparently traverse the credentials chain for you.
In Simple and flexible tool for managing secrets
drablyechoes·Oct 14, 2020
We use `sops`[1] to do this and it works really well. There is a Google Cloud KMS keyring (for typical usage) and a GPG key (for emergency/offline usage) set up to handle the encryption/decryption of files that store secrets for each application's deployment. I have some bash scripts that run on CI which are essentially just glorified wrappers to `sops` CLI to generate the appropriate `.env` file for the application, which is put into the container by the `Dockerfile`. Applications are already configured to read configuration/secrets from a `.env` file (or YAML/JSON, depending on context), so this works pretty easily and avoids depending on secrets being set in the `ENV` at build time. You can also, of course, pass any decrypted values from `sops` as arguments to your container deployment tool of choice (e.g. `helm deploy foo --set myapp.
Read the rest
db.username=${decrypted_value_from_sops}`) and not bundle any secrets at build time at all. [1] https://github.com/mozilla/sops
In Dockerfile Security Best Practices
antoncohen·Jun 12, 2020
The "Store secrets safely" section seems to propose three alternative solutions: store secrets encrypted in Git, expose secrets to applications with environment variables, and encrypt secrets with KMS. But those are solutions to different problems. You can use all three. For example you can use sops (https://github.com/mozilla/sops) to store encrypted secrets in Git, using AWS/GCP KMS to encrypt/decrypt them (or encrypt/decrypt the encryption key), and have infrastructure automation that gets the secrets from sops and exposes them to applications as environment variables.
In Best practices for managing and storing secrets like API keys and credentials

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.