SOPS

SOPS encrypts the values in your config files and leaves the keys readable, so secrets can live in git next to your code. You can see a file has a database_password field, but the value is gibberish until someone with the key decrypts it. MPL-2.0, free, and a CNCF sandbox project.

There's no server to run. It's a single binary that handles YAML, JSON, ENV, INI and binary files, and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, HashiCorp Vault or OpenBao, age, or PGP. sops edit secrets.yaml decrypts in your editor and re-encrypts on save. Field names stay plain, so a git diff shows which secret changed even when you can't read it.

The only cost is the key service you pick. age and PGP are $0. AWS KMS is $1/mo per key, and a small team stays inside the 20,000 free requests a month. Solo: use it with age. Small teams: use a cloud KMS so nobody's laptop holds the only key. Larger teams: keep it for config in git, and add Vault, OpenBao or Infisical (Infisical/infisical) when apps need secrets at runtime.

The catch: SOPS stores static secrets. It doesn't issue short-lived credentials or rotate them, and access is per file, not per secret. It can log decryptions to Postgres, but that's opt-in plumbing, not a dashboard. Lose your only key and the secrets are gone, so encrypt to more than one recipient.