7 minutes from now
Secrets in Git, Done Right
When you genuinely have a secret and your whole workflow is git, where does it live? Not plaintext in the repo, not a gitignored file passed around Slack. SOPS with age encrypts the values, commits the ciphertext, keeps git diffs readable, and decrypts only at the point of use. age gives modern key management without the PGP misery; SOPS gives the value-only, multi-recipient, git-friendly workflow. A team's access model becomes a reviewable list of public keys. Plus when SOPS beats Vault and the one thing you must not get wrong.