SecretSpec

A modern Rust dotenv implementation with literal dollars, round-trip rendering, and structured parse errors.

Move secrets safely between storage layouts, keep config and ephemeral values in the same declaration model, and make remote providers faster.

Declare, discover, migrate, and delete secrets from the CLI; use four new providers; and resolve the same manifests from Swift.

A local convenience became a secrets interface, an environment model, and a deployment format. It was never designed to be any of them.

Resolve only the secrets a service needs, cache remote secrets safely, and use age-encrypted files or native systemd credentials alongside new providers.

SOPS encrypts files. SecretSpec gives applications a portable contract for the secrets they need.

An audit of 445 NixOS modules shows the cost of making configuration and secrets share one interface.

Authenticate providers from another secret store, use Azure Key Vault or Gopass, export secrets for CI, and resolve them from PHP.

Native Python, Node.js, Go, Ruby, and Haskell bindings over the same Rust resolver as the CLI.

Require a human-readable reason whenever a coding agent reaches for your secrets.