good-door

jit is a local-first macOS command-line secrets manager from jitpass that moves development credentials from plaintext files such as .env, AWS credentials, shell exports, npm configuration, and MCP configurations into an encrypted vault protected by Touch ID. It rewrites source files with decoys so existing tools can continue working while the real value is released only to an authorized process. It provides credentials through per-process environment injection, native credential protocols such as AWS credential_process and Docker or Git credential helpers, and a named-pipe mount for tools that only read files. The named pipe is a mode-0600 POSIX FIFO: authorized reads receive decrypted values through the kernel pipe buffer without writing them to disk, while ambient readers receive decoys. jit is macOS-only for Apple Silicon and is still in development; the project states that it does not protect credentials after they enter the requesting process's memory.

OpenBao is an open-source software solution for managing, storing, and distributing sensitive data such as secrets, certificates, and keys. It encrypts arbitrary key/value secrets before writing them to persistent storage, supports storage on disk and PostgreSQL, and can generate system-specific dynamic credentials such as AWS or SQL database secrets on demand. Generated secrets have leases that clients can renew through built-in APIs and that OpenBao can automatically revoke; revocation can also target individual secrets or groups such as all secrets accessed by a user or of a particular type. OpenBao also provides encryption and decryption without storing the data, along with audit and key-rolling capabilities. The project is community-run under open-governance principles and is implemented in Go, with a command-line server and web UI.

1Password is a password, secrets, and access-management platform for securing human, machine, and AI-agent credentials. Its Credential Broker verifies agents and machine workloads at runtime, then provides only the credentials they are authorized to receive. The platform also supports enterprise password management, privileged access with just-in-time and just-enough access, and discovery and auditing of access to AI tools and SaaS applications.

HashiCorp Vault is a secrets-management product for securely storing, accessing, and controlling access to tokens, passwords, certificates, encryption keys, and other sensitive data. It can be used through a user interface, command-line interface, or HTTP API, including by agent runtimes that fetch credentials from the vault. Vault includes a key-value secrets engine for persisting arbitrary secrets, a database secrets engine that dynamically generates credentials from configured roles, and a Transit secrets engine that provides encryption as a service for data in transit. Its documented use cases include storing and deploying application, system, and infrastructure secrets, managing database credential lifecycles, and encrypting data at rest and in transit.

deepsec is an open-source, agent-powered vulnerability scanner and security harness from Vercel Labs for on-demand review of large codebases within the user's own infrastructure. It identifies candidate vulnerabilities, uses AI models to investigate them, supports triage and optional revalidation to reduce false positives, and can run work across parallel worker machines. The CLI initializes a repository with `npx deepsec init`, stores state and findings in a `.deepsec/` directory, and resumes interrupted runs while skipping files already analyzed. Subsequent commands separate fast pattern scanning from AI processing and revalidation, and findings can be exported as Markdown directories or JSON. Model access can use Vercel AI Gateway, direct OpenAI or Anthropic credentials, or a custom HTTPS provider; scan cost and duration can be capped with command-line options.