HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
getsops
sops
Go2015–2026
getsops / sops

sops

Simple and flexible tool for managing secrets

Security & PrivacyDevOps & Cloud
Explore on GitHubRead Hacker News discussions
81Distinct people
95Mentions
2Explicit recommenders
23.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Simple and flexible tool for managing secrets

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

I recommend against with using secrets managers as opposed to config files for storing configuration. Ideally, your configuration is versioned and code-reviewed. Config files…

xvector used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:02:44 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year95 dated mentions

Observed mentions: 2015-11-01 16:14:34 UTC to 2026-08-28 16:57:09 UTC.

0510152015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 5 mentions; 2 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 14 mentions; 2 submissions, 12 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 9 mentions; 2 submissions, 7 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 15 mentions; 1 submissions, 14 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 16 mentions; 0 submissions, 16 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 9 mentions; 2 submissions, 7 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC422
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC413
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC523
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC615
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC14212
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC413
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC927
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC15114
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC16016
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC927
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC808

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
SOPS: Secrets OPerationS SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP. (demo) Documentation You can find the SOPS documentation on getsops.io under "Docs". Security Please report any security issues privately using GitHub's advisory form. License Mozilla Public License Version 2.0 Authors SOPS was initially launched as a project at Mozilla in 2015 and has been graciously donated to the CNCF as a Sandbox project in 2023, now under the stewardship of a new group of maintainers. The original authors of the project were: Adrian Utrilla @autrilla Julien Vehent @jvehent Furthermore, the project has been carried for a long time by AJ Bahnken @ajvb, and had not been possible without the contributions of numerous contributors. Credits SOPS was inspired by hiera-eyaml, credstash, sneaker, password store and too many years managing PGP encrypted files by hand... We are a Cloud Native Computing Foundation sandbox project.
Read the full README on GitHub

What Hacker News says

16 sources
visualphoenix·Nov 27, 2024
Git-crypt is a dead product with numerous unresolved issues and drawbacks. Newer versions of git cause git to crash when invoking git-crypt[0]. It doesn’t scale with users: Off-boarding a key is a commit in git. Since it is trivially easy to rewind a git repo before the revocation commit and then decrypt with the revoked key, this means you need to rotate every key under management when any revoke is performed. It provides the illusion of asymmetric key encryption, but your asymmetric key wraps a shared symmetric key used to encrypt the entire repository. This also means a user could roll the repository back before a key was revoked and steal the symmetric key used to protect the repository and then use that key to decrypt the repository any time in the future. It doesn’t scale with the number of files under management. As a result of how
Read the rest
it’s implemented, every invocation is a separate process launch. This means every file triggers an asymmetric unwrap of the symmetric key. If you’re protecting your GPG key with hardware keyfob, decrypting the repository will take a long time. This product seemed like a cool idea for a while but it’s implementation leave much to be desired and has not stood the test of time… Password-store[1] does a better job than git-crypt for single user git based gpg encrypted password management. For multi-user git repo encryption I prefer Mozilla SOPS[2], especially when coupled with something like AWS KMS… But then you might consider stepping up to something like Hashicorp Vault[3] or Infisical[4]. [0] https://github.com/AGWA/git-crypt/issues/273 [1] https://www.passwordstore.org/ [2] https://github.com/getsops/sops [3] https://www.vaultproject.io/ [4] https://infisical.com/
In Git-crypt – transparent file encryption in Git
theozero·Oct 6, 2024
DMNO creator here - sensitive config values are able to be retrieved from a variety of backends using a flexible plugin system. We are certainly not telling you that you have to use the encrypted file method, and depending on the security requirements of your project it may not be a good choice. You can also mix and match those plugins, and segment items however you see fit - so it's not always a single key being passed around. That said, it is a valid way that some folks use (see https://dotenvx.com/, https://github.com/AGWA/git-crypt, https://github.com/getsops/sops) which can make sense for simpler projects with less stringent security needs. The bonus here is it does not require setting up, paying for, or integrating any external service, and helps save you from "secret sprawl". We have a plugin for 1password (which many teams are alr
Read the rest
eady using anyway) and have plugins planned for many other popular tools, including Infisical. Many other tools only really make sense for bigger enterprises, either due to cost, complexity, or both. Our goal here (or one of them anyway) is to make a tool that provides enough value to use in all cases, from very small and simple to very large and complex.
In DMNO: Environment Variables Evolved
hardwaresofton·Aug 5, 2024
I’ve used git-crypt[0] with great success. It uses git smudge so you never commit secrets if you set it up properly the first time. Unfortunately, it doesn’t support groups. For a solution that scales to teams, check out SOPS[1]. You have to do a little more work to be sure that secrets are ignored in the repo but it works reasonably well and is well known. Transparent support at the editor level (age.el) sounds really nice though. [0] https://github.com/AGWA/git-crypt [1] https://github.com/getsops/sops
In Age is a simple, modern and secure file encryption tool, format, and Go library
mplanchard·Jun 25, 2024
Seems pretty similar to sops[0], but without the encrypted-by-default feature that makes sops feel significantly safer for secret management. Sops also integrates easily with AWS and other existing key management solutions, so that you can use your existing IAM controls on keys. I mentioned in another comment, but I've been using it over five years at two jobs and have found it to be great. [0]: https://github.com/getsops/sops
In Show HN: From dotenv to dotenvx – better config management
daralthus·Jun 25, 2024
You can commit your secrets as an encrypted vault with this. Then decrypt it with a key where needed: locally, on CI, on prod, etc. This is basically a simplified version of Hashicorp's Vault, GCP key vault etc. with some less granularity on user authentication. It solves the issues around .env.example and is perfect for gitops. You have all your secrets for all your envs ready, while you only need to set a single env var (the private encrpytion key) on your specific hosting environment. You could even use separate keys per env, eg.: to give access to a developer to staging only. Mozilla's https://github.com/getsops/sops is another contender but with a more complicated (and perhaps more flexible) key management.
In Show HN: From dotenv to dotenvx – better config management
belthesar·Apr 29, 2024
This is interestingly similar to a little tool I wrote called sops-run [0], which manages encrypted secrets for cli tools using Mozilla’s sops [1]. Biggest upshot is that you can use it more confidently for secrets with encryption at rest. Built it when I was trying out CLI tools that wanted API keys, but I didn’t want to shove them into my profile and accidentally upload them into my dotfiles repository. Do need to finally get back to making this a package, being able to install it with pip(x) would be really nice. [0] https://github.com/belthesar/sops-run [1] https://github.com/getsops/sops
In Show HN: Dotenv, if it is a Unix utility

Showing the 15 most recent of 16 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.