Choosing Your Secrets Manager: 10+ Tools Compared for Security and Scale

# .env
DATABASE_URL=postgres://user:pass@localhost:5432/mydb
API_KEY=sk_live_abc123xyz789
JWT_SECRET=super_secret_key_do_not_share
REDIS_PASSWORD=redis_prod_password_2026

# The moment you realize you've made a mistake
$ git push
Enumerating objects: 15, done.
Counting objects: 100% (15/15), done.
Delta compression using up to 8 threads
Compressing objects: 100% (8/8), done.
Writing objects: 100% (9/9), 1.23 KiB | 1.23 MiB/s, done.
Total 9 (delta 6), reused 0 (delta 0), pack-reused 0
remote: Resolving deltas: 100% (6/6), completed with 3 local objects.
To github.com:your-org/your-repo.git
   8a3f2b1..9c4e5d6  main -> main

# Three minutes later...
Email from GitHub: "AWS credentials detected in your repository"

// lib/secrets.ts
import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";

const client = new SecretsManagerClient({
  region: process.env.AWS_REGION || "us-east-1"
});

export async function getSecret(secretName: string): Promise<Record<string, string>> {
  const command = new GetSecretValueCommand({ SecretId: secretName });
  const response = await client.send(command);

  if (!response.SecretString) {
    throw new Error("Secret is empty or binary");
  }

  return JSON.parse(response.SecretString);
}

// Usage in your app
export async function getDatabaseConfig() {
  const secrets = await getSecret("prod/db/credentials");
  return {
    host: secrets.host,
    user: secrets.username,
    password: secrets.password,
    database: secrets.dbname
  };
}

// lib/azure-secrets.ts
import { DefaultAzureCredential } from "@azure/identity";
import { SecretClient } from "@azure/keyvault-secrets";

const credential = new DefaultAzureCredential();
const vaultName = process.env.AZURE_KEY_VAULT_NAME!;
const url = `https://${vaultName}.vault.azure.net`;

const client = new SecretClient(url, credential);

export async function getSecret(secretName: string): Promise<string> {
  const latestSecret = await client.getSecret(secretName);
  return latestSecret.value!;
}

export async function setSecret(secretName: string, value: string): Promise<void> {
  await client.setSecret(secretName, value);
}

// Usage
export async function getConfig() {
  return {
    databaseUrl: await getSecret("database-url"),
    apiKey: await getSecret("api-key"),
    jwtSecret: await getSecret("jwt-secret")
  };
}

// lib/gcp-secrets.ts
import { SecretManagerServiceClient } from "@google-cloud/secret-manager";

const client = new SecretManagerServiceClient();
const projectId = process.env.GOOGLE_CLOUD_PROJECT!;

export async function accessSecret(secretId: string, version = "latest"): Promise<string> {
  const name = `projects/${projectId}/secrets/${secretId}/versions/${version}`;
  const [versionResponse] = await client.accessSecretVersion({ name });

  return versionResponse.payload?.data?.toString() || "";
}

export async function createSecret(secretId: string, value: string): Promise<void> {
  const parent = `projects/${projectId}`;

  // Create the secret if it doesn't exist
  await client.createSecret({
    parent,
    secretId,
    secret: {
      replication: {
        automatic: {}
      }
    }
  });

  // Add the first version
  await client.addSecretVersion({
    parent: `projects/${projectId}/secrets/${secretId}`,
    payload: {
      data: Buffer.from(value)
    }
  });
}

// Usage with caching
const secretCache = new Map<string, string>();

export async function getCachedSecret(secretId: string): Promise<string> {
  if (secretCache.has(secretId)) {
    return secretCache.get(secretId)!;
  }

  const value = await accessSecret(secretId);
  secretCache.set(secretId, value);

  return value;
}

// lib/vault.ts
import Vault from "node-vault";

const vault = Vault({
  endpoint: process.env.VAULT_ADDR,
  token: process.env.VAULT_TOKEN,
});

export async function getDatabaseCredentials(): Promise<{
  username: string;
  password: string;
}> {
  // Dynamic secrets - these are generated on-demand
  const result = await vault.read("database/creds/readonly");

  return {
    username: result.data.username,
    password: result.data.password,
  };
}

// Auto-revoke after use
export async function withDbCredentials<T>(
  fn: (creds: { username: string; password: string }) => Promise<T>
): Promise<T> {
  const creds = await getDatabaseCredentials();
  const leaseId = (await vault.read("database/creds/readonly")).lease_id;

  try {
    return await fn(creds);
  } finally {
    // Revoke immediately after use
    await vault.revoke({ lease_id: leaseId });
  }
}

// Example: Using Vault's KV engine
export async function getAppConfig(appName: string): Promise<Record<string, string>> {
  const result = await vault.read(`kv/data/${appName}`);
  return result.data.data; // KV v2 wraps data in another data object
}

// lib/doppler-config.ts
import { DopplerClient } from "@doppler/node";

const doppler = new DopplerClient({
  token: process.env.DOPPLER_TOKEN,
});

export async function getSecrets(project = "myapp", environment = "production") {
  const response = await doppler.secrets.get({
    project,
    environment,
  });

  return response.secrets;
}

// Usage with TypeScript types
interface AppConfig {
  DATABASE_URL: string;
  API_KEY: string;
  JWT_SECRET: string;
  REDIS_URL: string;
}

export async function getConfig(): Promise<AppConfig> {
  const secrets = await getSecrets();

  return {
    DATABASE_URL: secrets.DATABASE_URL.value,
    API_KEY: secrets.API_KEY.value,
    JWT_SECRET: secrets.JWT_SECRET.value,
    REDIS_URL: secrets.REDIS_URL.value,
  };
}

# Install Doppler CLI
curl -Ls --tlsv1.2 --proto "=https" --retry 3 \
  https://cli.doppler.com/install.sh | sh

# Login
doppler login

# Setup project
doppler projects setup

# Run with secrets injected
doppler run -- npm run start

# Export to .env (for local dev)
doppler secrets download --format env > .env

// lib/infisical.ts
import { InfisicalClient } from "@infisical/sdk";

const client = new InfisicalClient({
  siteUrl: "https://app.infisical.com", // or your self-hosted URL
  token: process.env.INFISICAL_TOKEN!,
});

export async function getSecrets(environment = "production") {
  const secrets = await client.getSecrets({
    environment,
    projectId: process.env.INFISICAL_PROJECT_ID!,
  });

  return secrets.reduce((acc, secret) => {
    acc[secret.secretKey] = secret.secretValue;
    return acc;
  }, {} as Record<string, string>);
}

// Usage with automatic refresh
export class SecretManager {
  private cache: Record<string, string> = {};
  private lastFetch: number = 0;
  private readonly CACHE_TTL = 300000; // 5 minutes

  async get(key: string): Promise<string> {
    const now = Date.now();

    if (now - this.lastFetch > this.CACHE_TTL) {
      this.cache = await getSecrets();
      this.lastFetch = now;
    }

    return this.cache[key];
  }

  invalidate() {
    this.lastFetch = 0;
  }
}

# Install Infisical CLI
npm install -g @infisical/cli

# Login
infisical login

# Initialize project
infisical init

# Run with secrets
infisical run --env=production -- npm run start

# Import from .env
infisical secrets import --env=development --file-path=.env.local

// lib/1password.ts
import { Client } from "@1password/secrets";

const client = await Client.create({
  serviceAccountToken: process.env.OP_SERVICE_ACCOUNT_TOKEN!,
});

export async function getSecret(secretPath: string): Promise<string> {
  const secret = await client.getSecret(secretPath);
  return secret.value;
}

// Usage
export async function getConfig() {
  return {
    databaseUrl: await getSecret("apps/myapp/database-url"),
    apiKey: await getSecret("apps/myapp/api-key"),
    jwtSecret: await getSecret("apps/myapp/jwt-secret"),
  };
}

# Install Connect CLI
curl -fsSL https://1password.com/downloads/connect-cli.sh | sh

# Login
op signin

# List secrets
op item list --vault "My App Secrets"

# Get secret
op read "op://My App Secrets/database-url/password"

# Run with secrets
op run -- npm run start

// lib/conjur.ts
import { ConjurClient } from "@cyberark/conjur";

const client = new ConjurClient({
  conjurUrl: process.env.CONJUR_URL!,
  conjurAccount: process.env.CONJUR_ACCOUNT!,
  credentials: {
    login: process.env.CONJUR_LOGIN!,
    apiKey: process.env.CONJUR_API_KEY!,
  },
});

export async function getSecret(secretId: string): Promise<string> {
  const secret = await client.retrieveSecret(secretId);
  return secret;
}

// Usage with policy enforcement
export async function getDatabaseCredentials() {
  const username = await getSecret("prod/database/username");
  const password = await getSecret("prod/database/password");

  return { username, password };
}

# .gitlab-ci.yml
variables:
  DATABASE_URL: $DATABASE_URL  # Protected variable
  API_KEY: $API_KEY

stages:
  - build
  - deploy

build:
  stage: build
  script:
    - npm install
    - npm run build
  variables:
    NODE_ENV: production

deploy:
  stage: deploy
  script:
    - echo "Deploying with API key: $API_KEY"
    - ./deploy.sh
  environment: production
  only:
    - main

# .github/workflows/deploy.yml
name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          API_KEY: ${{ secrets.API_KEY }}
          JWT_SECRET: ${{ secrets.JWT_SECRET }}

      - name: Deploy
        run: ./deploy.sh
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

# config.enc.yaml (encrypted file - safe to commit)
database:
  url: ENC[AES256_GCM,data:abc123...,iv:xyz789...,tag:tag123,type:str]
  username: ENC[AES256_GCM,data:def456...,iv:uvw012...,tag:tag456,type:str]
  password: ENC[AES256_GCM,data:ghi789...,iv:rst345...,tag:tag789,type:str]

api:
  key: ENC[AES256_GCM,data:jkl012...,iv:opq678...,tag:tag012,type:str]

# Create .sops.yaml configuration
cat > .sops.yaml <<EOF
creation_rules:
  - path_regex: .*\.enc\.yaml$
    kms: "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
    age: age1yhm3g6w8q8z9x0y1w2v3u4t5s6r7q8p9o0n1m2l3k4j5i6h7g8f9e0d
EOF

# Encrypt a file
sops -e config.yaml > config.enc.yaml

# Decrypt a file
sops -d config.enc.yaml > config.yaml

# Edit encrypted file directly
sops config.enc.yaml

# Use in CI/CD
sops -d config.enc.yaml | kubectl apply -f -

# .env.local - Safe for local dev
NODE_ENV=development
DEBUG=true
MOCK_API_URL=http://localhost:3001
DATABASE_URL=postgres://localhost:5432/myapp_dev

# .env.production - Should NEVER be in your repo
DATABASE_URL=postgres://prod-user:REDACTED@prod-db:5432/app
STRIPE_SECRET_KEY=sk_live_...
AWS_SECRET_ACCESS_KEY=...

// lib/config.ts
import dotenv from "dotenv";
import path from "path";
import { getSecret } from "./secrets"; // Your secrets manager

const env = process.env.NODE_ENV || "development";

// Load base .env file
dotenv.config({
  path: path.resolve(process.cwd(), `.env${env === "production" ? ".production" : ""}`)
});

// Load local overrides (never committed)
if (env === "development") {
  dotenv.config({
    path: path.resolve(process.cwd(), ".env.local"),
    override: true
  });
}

// In production, fetch sensitive values from cloud
export async function loadProductionSecrets() {
  if (env !== "production") return;

  const secrets = await getSecret("myapp/production");

  // Override with cloud values
  process.env.DATABASE_URL = secrets.databaseUrl;
  process.env.API_KEY = secrets.apiKey;
  process.env.JWT_SECRET = secrets.jwtSecret;
}

// Initialize
if (env === "production") {
  loadProductionSecrets().catch(console.error);
}

export const config = {
  env,
  database: {
    url: process.env.DATABASE_URL!,
    poolSize: env === "production" ? 20 : 5
  }
} as const;

# Initialize evnx
evnx init

# Link to your cloud provider
evnx link aws --secret-id myapp/development

# Pull secrets (creates encrypted .env)
evnx pull

# Run your app
evnx run npm run dev

# Push local changes (with approval workflow)
evnx push DATABASE_URL=postgres://new-host:5432/db

# Scan for security issues
evnx scan

# [SCAN] Scanning .env files...
# [ERROR] AWS_SECRET_ACCESS_KEY matches high-entropy pattern (256-bit key)
# [ERROR] Pattern: aws_secret (confidence: high)
# [INFO] 1 secret detected. Commit blocked.

// lib/evnx-config.ts
import { EvnxClient } from "@evnx/sdk";

const evnx = new EvnxClient({
  backend: "aws-secrets-manager",
  secretId: process.env.EVNX_SECRET_ID!,
  cacheTtl: 300 // 5 minutes
});

export async function getEnvWithFallback(key: string, fallback: string): Promise<string> {
  // Try cloud first, fallback to local .env
  const cloudValue = await evnx.get(key);
  return cloudValue || process.env[key] || fallback;
}

// Usage
export const config = {
  database: {
    url: await getEnvWithFallback("DATABASE_URL", "postgres://localhost/dev")
  }
};

// lib/rotation.ts
export async function rotateDatabaseCredentials() {
  const client = new SecretsManagerClient({});

  // Step 1: Create new credentials
  const newCreds = await createNewDatabaseUser();

  // Step 2: Update secret with both old and new
  await client.send(new UpdateSecretCommand({
    SecretId: "prod/db/creds",
    SecretString: JSON.stringify({
      ...newCreds,
      previousPassword: await getCurrentPassword()
    })
  }));

  // Step 3: Update database permissions
  await grantDatabaseAccess(newCreds.username);

  // Step 4: Schedule old credential removal
  setTimeout(async () => {
    await revokeDatabaseAccess(oldUsername);
  }, 24 * 60 * 60 * 1000); // 24 hours
}

// lib/secret-cache.ts
import NodeCache from "node-cache";

const secretCache = new NodeCache({ stdTTL: 300 }); // 5 minutes

export async function getCachedSecret(secretName: string) {
  const cached = secretCache.get(secretName);
  if (cached) return cached;

  const secret = await getSecret(secretName);
  secretCache.set(secretName, secret);

  return secret;
}

// Invalidate on update
export async function updateSecret(name: string, value: any) {
  await secretsManager.updateSecret(name, value);
  secretCache.del(name); // Clear cache
}

// lib/audit.ts
export async function logSecretAccess(
  secretName: string,
  userId: string,
  action: "read" | "write" | "delete"
) {
  await auditClient.putRecord({
    TableName: "SecretAuditLog",
    Item: {
      timestamp: new Date().toISOString(),
      secretName,
      userId,
      action,
      ipAddress: getClientIp(),
      userAgent: getUserAgent()
    }
  });
}

// Middleware example
export const auditSecretAccess = (secretName: string) => {
  return async (req: Request, res: Response, next: NextFunction) => {
    await logSecretAccess(secretName, req.user.id, "read");
    next();
  };
};

// lib/encrypted-env.ts
import crypto from "crypto";

const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY!; // 32 bytes
const IV_LENGTH = 16;

export function encrypt(text: string): string {
  const iv = crypto.randomBytes(IV_LENGTH);
  const cipher = crypto.createCipheriv("aes-256-cbc", Buffer.from(ENCRYPTION_KEY), iv);
  let encrypted = cipher.update(text, "utf8", "hex");
  encrypted += cipher.final("hex");
  return iv.toString("hex") + ":" + encrypted;
}

export function decrypt(text: string): string {
  const [ivHex, encrypted] = text.split(":");
  const iv = Buffer.from(ivHex, "hex");
  const decipher = crypto.createDecipheriv("aes-256-cbc", Buffer.from(ENCRYPTION_KEY), iv);
  let decrypted = decipher.update(encrypted, "hex", "utf8");
  decrypted += decipher.final("utf8");
  return decrypted;
}