> They sit on disk as plaintext, readable by any process running as your user

The proposed solution:

> Instead of loading secrets from a file, you use a wrapper script that fetches secrets from a secure store and injects them as environment variables into your process

Now they sit "on disk" as plaintext, in /proc/self/environ, still readable by any process running as your user.

You will probably really like https://varlock.dev

It’s a whole toolkit for this - with built in validation, type safety, and extra protection for sensitive secrets.

undefined

undefined

It may be marked as Beta, but I've been using https://developer.1password.com/docs/environments/ since October-ish with no issues.

Mfw typing the command stores the password in plaintext in my shell history

So the solution is to use a proprietary password manager instead? No thanks

People still code on their local boxes? op is not biometric secured over an ssh tunnel

Nice. One more benefit of this is when using LLM tools like Claude Code or Codex to do something and run tests on a worktree, this solution would work seamlessly.