SecretSpec
Applications that need passwords, API keys, or other credentials are usually built against one specific way of storing them: an environment variable, a cloud vendor's secrets service, or a password manager. Switching providers later, or running the same application in a different environment, typically means rewriting how the application looks up its secrets. SecretSpec addresses this by separating what an application declares it needs from where those values actually live.
An application author writes a single declaration listing the secrets required. Where each secret is actually stored is decided separately, per environment, by whoever is running the application. SecretSpec then resolves the declaration against whichever provider is configured. As the project describes its goal, it lets teams "manage secrets without hard-wiring your app to a secrets provider or leaking them through environment variables."
The tool supports 27 storage providers spanning several categories: cloud platforms such as AWS Secrets Manager, AWS Parameter Store, Azure Key Vault, Google Cloud Secret Manager, and Scaleway Secret Manager; password managers including 1Password, Bitwarden, LastPass, Dashlane, and Keeper Secrets Manager; self-hosted vaults such as Vault, OpenBao, Infisical, and Passbolt; and local or development-oriented formats including macOS Keychain, KeePass, age encryption, SOPS, systemd credentials, and plain .env files. This breadth means a project can move from a developer's laptop, to a self-hosted vault, to a cloud provider's managed service, without changing application code.
SecretSpec was built by Cachix for the devenv.sh project, and is released under the Apache 2.0 license with development happening publicly on GitHub.
SecretSpec is placed in Assess. It addresses a recognizable and recurring problem, provider lock-in for secret storage, with a design that keeps declaration and storage cleanly separated across a wide provider ecosystem. It has not yet been used first-person in a production pipeline, which is the gate for Trial. Worth exploring on the next project that needs to support more than one secrets backend.
