# SecretSpec

By Saurabh Kumar · TIL note, Jul 15, 2026 · Tags: devops, security

Source: https://saurabh-kumar.com/til/1784116800/

[SecretSpec](https://secretspec.dev/) declares secrets once in `secretspec.toml` (names + descriptions, never values) and resolves them from any of 11 backends: keyring, 1Password, Vault, AWS, GCP, .env. Same command everywhere: `secretspec run --profile production -- npm start`. Per-secret fallback chains (`providers = ["vault", "keyring", "env"]`) and a `ref = { item, field }` form points at a secret you already have elsewhere, no renaming. Sharpest bit: agents get held to a stricter bar by default. `require_reason = "agents"` forces `secretspec run --reason "..."` before an AI agent can read a secret, appended to a local audit log; humans running interactively are unaffected. Rust core, SDKs for Python/Go/Node/Ruby/PHP/Haskell. Worth piloting on a project drowning in `.env` sprawl.