Self-Hosted Secrets Management Vaults

Vault is a centralized secrets management platform designed to secure, store, and control access to sensitive credentials such as API keys, passwords, certificates, and encryption keys. At its core, the system employs a barrier-based cryptographic sealing mechanism that requires an unseal process to decrypt internal storage, ensuring that sensitive data remains protected. It provides identity-based access control to manage granular permissions across distributed infrastructure, effectively centralizing security policies and authentication for both human and machine workloads. What distinguish

OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.

Infisical is a centralized secrets management platform designed to store, synchronize, and control access to sensitive credentials and configuration data across distributed development, staging, and production environments. It employs client-side encryption to ensure that secrets remain unreadable to the underlying storage infrastructure, while providing a hierarchical permission model to govern both user and machine access. The platform distinguishes itself through dynamic credential provisioning, which generates short-lived access tokens that are automatically revoked after use. It supports

CyberArk Conjur automatically secures secrets used by privileged users and machine identities

This project is a Spring Boot administrative framework and enterprise backend boilerplate designed for building management systems. It provides a foundation for enterprise-level applications using a reactive programming model and non-blocking data access patterns. The framework includes a reactive CRUD system for database operations and a role-based access control system to manage user accounts and administrative permissions. It further distinguishes itself with a centralized data dictionary for maintaining standardized labels and values across application modules. The system's broader capab

This is a role-based access control system for Laravel applications that manages user permissions and roles within a database. It provides a database permissions manager to assign specific abilities to users and roles, utilizing authorization gates to restrict access to routes and interface elements. The project features a wildcard permission system that uses pattern matching to grant broad access across multiple related permissions. It also supports team-scoped access control, allowing users to maintain different roles and permission levels across separate organizational contexts or teams.

Flagsmith is an open-source platform for managing feature flags and remote configuration across web, mobile, and server applications. It provides a comprehensive REST API for programmatic management of flags, segments, and identities, and can be deployed on private infrastructure for secure, compliant feature flag management with full operational control. The platform distinguishes itself through a server-side flag evaluation engine that resolves segments, traits, and percentage rollouts per request, alongside a multivariate flag variant system supporting multiple typed values with configurab

This project is a cross-platform credential management suite designed to store sensitive information in encrypted local databases. It functions as a secure desktop application that provides a unified environment for organizing secrets, generating passwords, and managing multi-factor authentication tokens. By utilizing industry-standard file formats, the application ensures that stored credentials remain secure and interoperable across different operating systems. The software distinguishes itself through deep integration with hardware-backed security and system-level services. It supports phy

Blog.Core is a production-ready backend boilerplate for building enterprise APIs and microservices using ASP.NET Core. It provides a foundational infrastructure for distributed systems, including tools for database-first scaffolding and the implementation of multi-tenant API frameworks. The project distinguishes itself through automated data layer generation, which produces entity models and repository layers directly from database schemas. It implements a centralized identity management system using standard identity server protocols to handle authentication and authorization across multiple

This project is an Android password manager application that provides an end-to-end encrypted vault for storing and synchronizing login credentials, secure notes, and identities. It functions as a secure storage system using zero-knowledge encryption to ensure that only the user can decrypt their stored data. The application integrates directly with the Android system to provide an autofill service that populates usernames and passwords into mobile apps and browser login fields. It also serves as a passkey management wallet for FIDO2 cryptographic passkeys and a time-based one-time password a

Kanidm is a centralized identity management server designed to handle authentication, authorization, and directory services across distributed infrastructure. It provides a comprehensive framework for managing human and service accounts, utilizing a schema-driven database to store identity records, group memberships, and system attributes. The platform supports a wide range of authentication methods, including passkeys, passwords, and standard protocols like OAuth2, OIDC, LDAP, and RADIUS. The system distinguishes itself through a granular access control engine that enforces security policies

Consul Template is a configuration renderer and dynamic configuration manager that generates files by populating templates with data from Consul and Vault. It functions as a service discovery template engine and secrets management integrator, transforming cluster catalog and health data into formatted configuration files. The tool distinguishes itself by acting as a process supervisor and notifier, capable of executing shell commands or restarting applications automatically after templates are updated. It features a long-polling watcher to monitor remote key-value stores and employs a shared