Topics / #secrets

Secrets projects on GitHub

Tools for storing, sharing, and scanning secrets like API keys and credentials.

As of , the most-starred Secrets projects on GitHub are trivy (38.5K stars), vault (36.4K stars) and gitleaks (30.1K stars). GitHub.Locker tracks 19 Secrets repositories with 315K stars combined. The fastest-growing on October 17 was treg, with +95 stars in a day.

19Projects
315KStars in total
+279Stars in a day
Browse in the catalog →github.com/topics/secrets ↗

Hot right now

Most stars gained in a day · Oct 17

+95

treg

superdesigndev/treg · ★ 5.7K

Treg is OpenRouter for agent tools: one base URL and one token let an agent call 3,000+ catalogued endpoints across 60+ providers — SEO, enrichment, ads, scraping, image and video generation — plus your team's own keys, skills and CLIs.

+38

gitleaks

gitleaks/gitleaks · ★ 30.1K

Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

+27

infisical

Infisical/infisical · ★ 29.8K

Infisical is an open-source security platform teams use to centralize secrets, certificates, and privileged access, with syncing, rotation, and leak prevention built in.

+22

cayu

cayu-dev/cayu · ★ 918

Cayu is an open-source Python framework for building and running domain-specific long-horizon AI agents, with a durable runtime built in that handles sessions, task dispatch, recovery, approvals, and observability.

The all-time top

19 projects · by stars

  1. #1 · aquasecurity/trivy

    trivy

    Trivy is an all-in-one security scanner that finds vulnerabilities, misconfigurations, secrets, and software licenses across container images, filesystems, git repositories, VM images, and Kubernetes clusters.

    38.5K
  2. #2 · hashicorp/vault

    vault

    Vault is a tool for securely accessing secrets such as API keys, passwords, and certificates, giving you a unified interface with tight access control and detailed audit logging.

    36.4K
  3. #3 · gitleaks/gitleaks

    gitleaks

    Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, or anything you pipe in via stdin.

    30.1K
  1. 4

    infisical

    29.8KInfisical/infisical · TypeScript

    Infisical is an open-source security platform teams use to centralize secrets, certificates, and privileged access, with syncing, rotation, and leak prevention built in.

  2. 5

    trufflehog

    28.6Ktrufflesecurity/trufflehog · Go

    TruffleHog is a CLI tool that discovers, classifies, validates, and analyzes leaked secrets like API keys, database passwords, and private keys across many sources (Git, GitHub, S3, Docker, Slack, filesystems, and more).

  3. 6

    chezmoi

    22Ktwpayne/chezmoi · Go

    chezmoi manages your dotfiles — the personal configuration files in your home directory — across several, possibly very different machines, with security treated as a core feature rather than an afterthought.

  4. 7

    dotenv

    20.5Kmotdotla/dotenv · JavaScript

    A zero-dependency Node.js module that loads environment variables from a .env file into process.env, following the Twelve-Factor App principle of keeping configuration separate from code.

  5. 8

    semgrep

    17.1Ksemgrep/semgrep · C

    Semgrep is a fast, open-source static analysis tool that scans source code to find bugs, security issues, and enforce coding standards using rules that look like ordinary code rather than abstract syntax trees or regex.

  6. 9

    dagger

    16.3Kdagger/dagger · Go

    Dagger is an open-source engine for automating software delivery: it builds, tests and ships any codebase, reliably and at scale.

  7. 10

    OpenSandbox

    15.9Kopensandbox-group/OpenSandbox · Python

    OpenSandbox is a general-purpose sandbox platform for AI applications that provides multi-language SDKs, unified sandbox APIs, and Docker/Kubernetes runtimes for scenarios like coding agents, GUI agents, agent evaluation, AI code execution, and RL training.

  8. 11

    direnv

    15.5Kdirenv/direnv · Go

    direnv is an extension for your shell that loads and unloads environment variables depending on the current directory, keeping project-specific settings out of your ~/.profile.

  9. 12

    git-secrets

    13.4Kawslabs/git-secrets · Shell

    git-secrets is a command-line tool that scans your git commits, commit messages, and merges to stop you from accidentally committing passwords, AWS keys, and other secrets.

  10. 13

    YubiKey-Guide

    12.5Kdrduh/YubiKey-Guide · HTML

    A community guide for using a YubiKey hardware security key to store GnuPG (PGP) keys and SSH keys, so cryptographic secrets live on a physical device instead of a disk.

  11. 14

    Reloader

    10.5Kstakater/Reloader · Go

    Reloader is a Kubernetes controller that watches ConfigMaps and Secrets and automatically triggers rolling restarts of the workloads that reference them — Deployments, StatefulSets, DaemonSets and more.

  12. 15

    treg

    5.7Ksuperdesigndev/treg · Python

    Treg is OpenRouter for agent tools: one base URL and one token let an agent call 3,000+ catalogued endpoints across 60+ providers — SEO, enrichment, ads, scraping, image and video generation — plus your team's own keys, skills and CLIs.

  13. 16

    cayu

    918cayu-dev/cayu · Python

    Cayu is an open-source Python framework for building and running domain-specific long-horizon AI agents, with a durable runtime built in that handles sessions, task dispatch, recovery, approvals, and observability.

  14. 17

    chat-archive-guard

    867MaxHu-xuan/chat-archive-guard · Python

    ChatArchiveGuard is a local, read-only CLI auditor you run on an AI chat export before sharing, migrating, or archiving it. It flags likely secrets and personal-data patterns, finds malformed UTF-8/JSON/JSONL, checks SQLite integrity, and reports scan coverage gaps.

  15. 18

    job-application-agent

    159vaibhavarora14/job-application-agent · JavaScript

    Job Application Agent is an Agent Skill that plugs into a coding agent (Claude, Cursor, Codex) to discover, evaluate, apply to, and track your own job applications using one verified résumé and verified facts only.

  16. 19

    codex-guard

    136Akimiya-z/codex-guard · JavaScript

    Codex Guard is a quality gate that automatically runs on pull requests it detects as agent-written (Codex, Claude, Copilot) and blocks leftover TODO markers, leaked secrets, sloppy commit messages, and red CI before they reach main.

Often tagged together