We do the exact same thing to keep track of some credentials we use sops[1] and AWS KMS to separate credentials by sensitivity, then use the git differ to view the diffs between the encrypted secrets
Definitely not best practice security-wise, but it works well
[1] https://github.com/getsops/sops
In Tracking SQLite Database Changes in Gitgetsops
sops
Go2015–2026
getsops / sops
sops
Simple and flexible tool for managing secrets
81Distinct people
95Mentions
2Explicit recommenders
23.7KGitHub stars
What to know before exploring
What it is
Simple and flexible tool for managing secrets
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I recommend against with using secrets managers as opposed to config files for storing configuration. Ideally, your configuration is versioned and code-reviewed. Config files…
xvector used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- agwa/git-crypt · linked in 4 of the same discussions
- filosottile/age · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:02:44 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year95 dated mentions
Observed mentions: 2015-11-01 16:14:34 UTC to 2026-08-28 16:57:09 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 4 | 2 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 5 | 2 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 14 | 2 | 12 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 15 | 1 | 14 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 16 | 0 | 16 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 8 | 0 | 8 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
SOPS: Secrets OPerationS
SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY
formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP.
(demo)
Documentation
You can find the SOPS documentation on getsops.io under "Docs".
Security
Please report any security issues privately using GitHub's advisory form.
License
Mozilla Public License Version 2.0
Authors
SOPS was initially launched as a project at Mozilla in 2015 and has been
graciously donated to the CNCF as a Sandbox project in 2023, now under the
stewardship of a new group of maintainers.
The original authors of the project were:
Adrian Utrilla @autrilla
Julien Vehent @jvehent
Furthermore, the project has been carried for a long time by AJ Bahnken @ajvb,
and had not been possible without the contributions of numerous contributors.
Credits
SOPS was inspired by hiera-eyaml,
credstash,
sneaker,
password store and too many years managing
PGP encrypted files by hand...
We are a Cloud Native Computing Foundation sandbox project.
Read the full README on GitHubWhat Hacker News says
15 sourcesFor anyone new to SOPS like I was - https://github.com/getsops/sops
In The Twelve-Factor App (2011)> If you want secure config storage on Kubernetes, you end up using Secrets, which ends up being key-value like env vars anyway.
You can load the secret file directly into the app, no need to load it as env vars or keep it strictly as key-value pairs.
> If you want similar security with Git you need a layer of encryption, which breaks diffs and requires additional tooling. This all leads back to why high-level deployment tools like Heroku were created.
You can use tools like ejson[1] or sops[2] to get encrypted files checked into Git that have key level granularity on diffs.
There is definitely a place for higher level abstractions than Kubernetes. Mostly it gives operators a standard platform to build from when teams outgrow the PaaS sandbox.
[1] https://github.com/Shopify/ejson
[2] https://github.com/getsops/sops
In The Twelve-Factor App (2011)I've found this is largely solved by strictly separating plain config and secrets, and then having secrets pull from GCP secret manager / vault / whatever.
You can then commit all the config (including the secret identifiers) and it all just works so long as you're authenticated with your secret storage system.
We do this for the live configuration as well in line with Gitops and find it to work well.
If you don't want to use a cloud secret manager you can also use something like https://github.com/getsops/sops to commit the encrypted secrets safely
In Show HN: Shello – Wrangle environment variablesThanks!
Another useful tool that can be added into a solution:
https://github.com/getsops/sops
In Ask HN: Any Encrypted Notes Backup?> > Maybe something that supports backends like AWS KMS (for encryption) or AWS Secret Manager (for storing/retrieving ) secrets.
> This is actually a feature I'd love OpenTF to have and am quite passionate about, personally
You're probably already aware, but SOPS¹ kinda fits the bill for integration here perfectly.
It supports local secrets as well as encryption via keys stored with all the big cloud providers, and it's already battle-tested as it is used heavily at Mozilla (it comes from there).
Additionally, like OpenTF, SOPS is maintained independently of any single corporation, written in Go, and distributed under the MPL-2.0 license. On its face, it seems like a match made in heaven.
SOPS is a great tool and could be a pretty killer starting point for this stuff!
--
1: https://github.com/getsops/sops
In OpenTF announces fork of TerraformBasically, the simpler the better -- just encrypt your secrets and check them in to version control.
We use SOPS[0] for this, and have found it to be pretty nice.
[0]: https://github.com/getsops/sops
In Check your secrets into Git [video]This is pretty cool!
Mozilla SOPS¹ also supports this, but it's not nearly as user friendly for non-technical folks. Probably one of those solutions you reviewed before creating Banana Split!
--
1: https://github.com/getsops/sops
In Shamir Secret SharingSome folks use tools like https://github.com/mozilla/sops to store most secrets (besides the sops key, of course) in source control. Of course, you aren't committing the cleartext but if the repo gets published you should probably rotate your keys just to be safe...
In GitHub Private Repos Considered Private-IshLooks like no[1] but there's an attempt to get it taken over by cncf to fix that[2].
1: https://github.com/mozilla/sops/discussions/927
2: https://github.com/cncf/sandbox/issues/28
In Mozilla/Sops: Simple and flexible tool for managing secretsMozilla/Sops: Simple and flexible tool for managing secrets
116 points · Open discussionMy experience is similar to the other comments here:
- A combination of sops[1] and AWS Parameter Store might be a good candidate for (4)
- (5) can be solved with AWS SSO / OIDC (also: platforms that offer OIDC, usually support that feature for free, and a variety of them can be configured via Terraform)
- For (6), there are solutions like Atlantis[2] for Terraform, but I am not familiar with alternatives for Pulumi and Ansible. Might be a good idea to spend some time and build a pipeline with whichever CI/CD platform you are using (bonus: GitHub Actions supports OIDC auth with AWS as an IAM role[3], no secrets nor credentials required!)
- For (7), you can create a separate AWS account and manage it with AWS Organizations (or not)
- For (8), 1pass[4] for any credentials that requires username/password combo (non-tech/breakglass account).
Read the rest
Groups can be created to limit certain credentials to subsets of users
[1] https://github.com/mozilla/sops
[2] https://www.runatlantis.io/docs/repo-level-atlantis-yaml.htm...
[3] https://docs.github.com/en/actions/deployment/security-harde...
[4] https://support.1password.com/custom-groups/
Sops is great. I hope they will find new maintainers. https://github.com/mozilla/sops/discussions/927
In Age: Modern file encryption format with multiple pluggable recipientsI ran into this recently when using https://github.com/mozilla/sops. It worked pretty nicely and as a tool was quite easy to get started with.
In Age: Modern file encryption format with multiple pluggable recipientsI like SOPS [0], but it might be a bit heavyweight. You can also use team versions of password managers for simpler tasks.
[0] https://github.com/mozilla/sops
In Keybase.pub Shutting Down on March 1 2023