getsops/sops

SOPS, short for Secrets OPerationS, is a command-line tool for safely storing and editing sensitive configuration files, things like API keys, database passwords, and certificates that you don't want to commit to a Git repository in plain text. Instead of either hiding these files entirely or trusting every collaborator with a single shared password, SOPS encrypts only the values inside a file, leaving the keys and overall structure readable. That way a teammate can still glance at a config and see which secrets exist and how they're organised, even if they can't read the actual values. Under the hood, SOPS works with YAML, JSON, ENV, INI, and binary files, and it can encrypt them using AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, or PGP, the choice of which is made by the team running it. A single file can be unlocked by any one of several configured keys, so different teammates or services each use their own credential without a shared master password. The typical workflow is to run sops edit on a file: SOPS decrypts it transparently, opens it in your editor, then re-encrypts it when you save. Decryption works the same way, and applications can also use SOPS as a Go library to decrypt secrets at runtime. Teams reach for SOPS when they want to keep secrets in version control alongside the rest of their infrastructure code, which is common in DevOps and GitOps setups. It is written in Go and installs as a single binary; recent builds require Go 1.25 to compile from source. The full README is longer than what was provided.