Open source · macOS CLI

dev-secret

Developer credentials, one command at a time.

dev-secret stores developer credentials in a dedicated macOS keychain and passes selected secrets to individual commands as environment variables. Keep tokens out of your shell configuration and choose which commands receive them.

Get started Source code on GitHub

Star on GitHub

Install and use

Requires macOS with its built-in /bin/bash and security(1). Optional Touch ID unlock also needs Swift from the Xcode Command Line Tools (xcode-select --install).

The latest release installer downloads its release’s script, checks its pinned SHA256, and installs to ~/.local/bin. Make sure that directory is in your PATH.

curl -fsSL https://github.com/sibest19/dev-secret/releases/latest/download/install.sh | bash

You can inspect and verify the installer before running it. See releases and the changelog for updates.

Try it with a placeholder

Initialize the keychain, then enter ghp_EXAMPLE at both hidden prompts. This placeholder is not a working GitHub token; gh auth status requires the separately installed GitHub CLI and a valid token for real use.

dev-secret init
dev-secret set GITHUB_TOKEN
dev-secret run GITHUB_TOKEN -- gh auth status

The token goes to the command’s environment, without being exported into your calling shell. Read the complete documentation and command reference for migration, locking, and other commands. Source installs also include man dev-secret.

Security and its limits

dev-secret wraps security(1) and uses a dedicated, encrypted, file-based macOS keychain. It reduces plaintext credentials in dotfiles and limits which commands receive them. The keychain automatically locks after one hour.

Same-user malware is outside its protection. While the keychain is unlocked, any process running as you can read its items. Root and a compromised OS are also out of scope.
Touch ID is a convenience, not a security boundary. Its enrollment stores the keychain password in the login keychain, readable by processes running as you without a prompt. The Touch ID check only gates dev-secret’s own unlock path.
Large secrets can appear in process arguments. Values longer than about 1.9 KB use a fallback that briefly exposes the value in the process list while storing it; the tool warns you.
Imports leave plaintext backups. import-env creates backups with 0600 permissions. Delete them after verifying the import; the secrets remain on disk until you do.
The receiving command must be trusted. It and its children can log or leak the credentials they receive. get prints secrets to the terminal; prefer run.

Read the full threat model and known weaknesses before relying on the tool. Only the latest release receives security fixes.

Report vulnerabilities privately through GitHub private vulnerability reporting, following the security policy. Use placeholder values and do not open a public issue for security problems.

Help improve dev-secret

Contributions use GitHub issues and pull requests. Start with an issue for a bug or feature, then submit a focused pull request. Follow the contribution instructions for setup, tests, and review requirements.

License

The current source is licensed under the GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later). Earlier releases published under MIT retain their original MIT permissions. The changelog records the license change for future versions.