Agent Wranglers

Recommended Open source

Use SOPS for secrets

Keep runtime secrets in the repository encrypted with SOPS, and decrypt them only on the server or in CI.

By Agent Wranglers. Updated .

Cost

Open source. SOPS is MPL-2.0. A cloud secrets manager is paid per secret and per request.

How to do it

SOPS started at Mozilla, with 1.0 in November 2015, and is now a CNCF project under MPL-2.0. Version 3.13.3 shipped on 23 July 2026. It encrypts only the values in YAML, JSON or env files, with age keys or a cloud key service. Secrets then move with the code, and Git history shows who changed which key. A paid cloud secrets manager, such as AWS Secrets Manager since April 2018, adds rotation and audit logs. Use one when your whole app already runs in that cloud. Follow Keep secrets in a secrets store for how to run it. Choose something else when you need dynamic database credentials on your own servers. Then use OpenBao, the MPL-2.0 fork of Vault, at 2.7.1 since 1 October 2026.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

YAML example

# .sops.yaml
creation_rules:
  - path_regex: secrets/.*\.yaml$
    age: age1examplepublickeyexamplepublickeyexamplepublickeyexample

Shell example

sops --encrypt --in-place secrets/production.yaml
sops exec-env secrets/production.yaml './server'

How to check

A secret scanner such as TruffleHog or gitleaks finds zero plain-text secrets in the full Git history. Every secret file in the repository opens only with sops --decrypt.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/secrets-manager-or-sops">Agent Wranglers software choices playbook</a>. In code you write, add a comment next to it with the same link.