I write a lot of code, open source, and as part of large engineering teams. How poorly teams manage their development secrets, some that often overlap with production blows my mind. So I coded what I hope is a decent solution.
So, I don't know how prevalent or wide spread this problem is. But here it is: you join a new team and someone slacks you the .env file filled with 50+ API keys, client ids, secrets, it's a shell-like file, so some come with comments "please go sign up and replace this token with your own". But others don't. The entire team uses one key for a service X. And among the keys that folks share in development may just a few: three to five, are the same as the production keys. Noice. Oh wait, .env is git-ignored. Phew!
Cause nobody ever made a copy and accidentally committed it, as .env-alex and that fuzzy and warm git ignore rule only mentioned **/.env, so .env-alex went through and, well we squash merged the branches, so we are ok. Right? Gosh. God no. GitHub support ticket to kill your orphan commit may not be enough.
The onboarding wiki says "get the .env from a fellow developer, using slack, email or airdrop" and then change the couple that require individual logins.
Ever since I worked at Coinbase, and on my first week on the Infra team the guy sitting next to me ended up getting phished, resulting in him delivering his laptop to the op-sec team and that day they identified not one but two zero days in Firefox by air-gapping his laptop. Someone had spent about a mil on dark web to get into his laptop! (I should
Since then, and especially now with all the AI agents about to become leet hackers, I am just in shock at how some engineers are so clueless about Whats about to happen!
My personal recommendation, if you are on GMail as your personal, and you are not using Advanced Protection with hardware keys, you will be hacked in the next year or so.
https://landing.google.com/advancedprotection/
Anyway. In the last six years i worked on four or five projects where dev secrets were a very fleeting afterthought. So this year I wrote a tool that does not compromise on security but gives you a safe way to keep your goddamn secrets in git and not stress about it.
It's a Rust based CLI tool that's a simple orchestrator on top of SOPS, age and age hardware plugins. Ok Mac with new Silicon processor it uses Secure Enclave to mint the keys. Or a YubiKey.
I am looking for feedback and beta testers! This is a free tool distributed under the MIT license. Adoption is what I worry about.
So please, give it a whirl.
Version 2.0.0 is out, supporting YubiKeys and a slew of new features.
Thanks!
Konstantin
Top comments (0)