Why not store secrets in code or environment files?

Hardcoded or plaintext secrets leak through source control, build logs, container images and backups, and many stay valid long after they leak. Zeabur's October 2026 breach began with a non-expiring admin token and an AWS key stored in plaintext in a private repository.

What is a dynamic secret?

A dynamic secret is a short-lived credential generated on demand, for example a database login that a secrets manager creates for one workload and revokes after a set time. It reduces the value of a leaked credential because it expires on its own.

What are the best secrets management tools?

Cloud-native options are AWS Secrets Manager, Azure Key Vault and Google Cloud Secret Manager. Cross-cloud platforms include HashiCorp Vault (IBM), Akeyless, Infisical, Doppler and Idira Secrets Manager (formerly CyberArk Conjur). GitGuardian detects secrets that leak into code. The right choice depends on how many clouds you run and whether you need dynamic secrets.

What is the best open source secrets manager?

Infisical's core is MIT licensed and free to self-host. OpenBao is the Linux Foundation fork of Vault created after HashiCorp moved Vault to the Business Source License in August 2023. Vault Community remains free to self-host under that licence, and Conjur Open Source is free to self-operate. SOPS suits teams that keep encrypted secrets in Git.

How much does a secrets manager cost?

Secrets management is one of the most transparent identity categories. Checked in November 2026: AWS Secrets Manager costs $0.40 per secret per month plus $0.05 per 10,000 API calls; Doppler is free for 3 users and $21 per user per month on Team; Infisical is free for 5 identities and $20 per identity per month on Pro, billed annually.

How often should secrets be rotated?

There is no single correct interval. Rotation triggered by an event, such as a leak, a departure or a vendor breach, matters more than a calendar. The stronger goal is to stop issuing long-lived secrets at all and use dynamic secrets or workload identity instead.

What Is Secrets Management? Tools, Open Source and Pricing

Q: What is secrets management?

Secrets management is the practice of securely storing, distributing, rotating and auditing the credentials that applications and infrastructure use, such as API keys, database passwords, tokens and certificates, so they are never hardcoded in source or configuration.

Secrets management is how you store, distribute, rotate and audit the credentials that applications and infrastructure use: API keys, database passwords, tokens and certificates. A secrets manager keeps them in one controlled place and hands them to workloads at runtime, so they never sit in source code or configuration files. These are non-human identity credentials, and leaked ones are a leading cause of cloud breaches.

The problem

Secrets end up hardcoded in source, baked into images and pasted into config. Once leaked, many stay valid for a long time. GitGuardian found 4,576 n8n API tokens in public GitHub commits in August 2026, and about 36 percent of the reachable instances it tested still accepted at least one. Exposed secrets were the most common starting point of the non-human identity breaches in SWI's Identity Breach Report 2026.

What good looks like

Central vault instead of secrets scattered across repos and pipelines.
Dynamic, short-lived secrets issued on demand rather than long-lived static keys.
Automated rotation so exposure windows stay small.
Detection of secrets that leak into code, logs and tickets.
Audit of who and what read each secret, and when.
Workload authentication to the vault that is not itself a static secret, such as cloud IAM roles or Kubernetes service account tokens.

Types of secrets management tools

Type	Examples	Best when	Limits
Cloud-native secret store	AWS Secrets Manager, Azure Key Vault, Google Cloud Secret Manager	One main cloud, workloads already use its IAM	Each cloud is a separate island
Cross-cloud vault with dynamic secrets	HashiCorp Vault, Akeyless, Idira Secrets Manager	Multi-cloud, on-premises, database credentials on demand	Operating effort (self-hosted Vault) or quote-based pricing
Developer-first secrets platform	Infisical, Doppler, 1Password Secrets Automation	Syncing app config to CI and many environments	Fewer dynamic secret engines
PAM-adjacent DevOps vault	Delinea DevOps Secrets Vault	Teams already on Delinea PAM	Tied to that ecosystem
Secrets detection	GitGuardian	Finding what already leaked	Does not store secrets

Open source secrets managers

Searches for an open source secrets manager usually lead to five options:

Vault Community is free to self-host, but HashiCorp moved Vault to the Business Source License on 10 August 2023, which is not an OSI-approved licence. Vault is now an IBM subsidiary.
OpenBao is the fork created after that change, governed under the Linux Foundation and, since June 2025, OpenSSF.
Infisical is MIT licensed outside its enterprise directories, with no user cap.
Conjur Open Source is free to self-operate; the commercial product is now sold as Idira Secrets Manager after Palo Alto Networks' acquisition of CyberArk (closed 11 February 2026, rebranded 12 May 2026).
SOPS encrypts secrets in files kept in Git.

Self-hosting moves the cost from licence to engineering time: unsealing, upgrades, backups and high availability. See the top open source secrets management tools and HashiCorp Vault alternatives.

What secrets managers cost

Secrets management scores 78 out of 100 in SWI's Identity Pricing Transparency Index 2026, behind only password managers (93) and open-source IAM (80): two thirds of secrets vendors publish a paid price. Checked on 5 November 2026 unless noted:

Product	Free entry	Paid price	Billing unit
AWS Secrets Manager	No separate trial (general AWS Free Tier credits)	$0.40 per secret per month, plus $0.05 per 10,000 API calls	Secret and API call
Google Cloud Secret Manager	6 versions and 10,000 accesses a month	About $0.06 per active version per month per location, $0.03 per 10,000 operations	Version and operation
Azure Key Vault	Not listed	$0.03 per 10,000 operations (East US retail list)	Operation
Doppler	Free for 3 users	Team $21 per user per month	User
Infisical	Free for 5 identities	Pro $20, Advanced $40 per identity per month, billed annually	Identity
Akeyless	5 clients, 500 static secrets	Enterprise quote	Clients, transactions
Delinea DSV	250 secrets, 20,000 API calls a month	Quote	Secrets, API calls
HashiCorp Vault	Community, self-hosted	HCP Vault Dedicated per cluster-hour and per client, no list price	Cluster and client

Note that HCP Vault Secrets, HashiCorp's lighter hosted product, reached end of life on 1 July 2026. Read the billing unit before you compare: a per-secret price favours few large secrets, a per-user or per-identity price favours many secrets per app.

Failure modes, with real incidents

CI secrets dumped by a poisoned dependency. The March 2025 tj-actions/changed-files compromise printed CI runner secrets into workflow logs that anyone could read on public repositories. The Shai-Hulud 2.0 worm harvested credentials from local files, environment variables and cloud secret managers on developer machines (secrets in repositories and CI).
A credential extracted from a build image. In the Codecov case a storage credential pulled from a Docker image let an attacker modify a script that sent customers' CI environment variables out.
One token, all the code. The New York Times lost about 273 GB of source code through a GitHub credential exposed in January 2024.
The secrets platform holds the keys too. CircleCI's attacker stole customer environment variables and the encryption keys needed to read them, from an engineer's session.
Deleted is not revoked. LiteLLM's poisoned release traced to an admin key removed from a public repository but never revoked (static API key abuse).

The measure that matters

The useful metric is not how many secrets are in the vault. It is how many exist outside it. A vault full of static database passwords improves auditability and changes very little about blast radius; generating a short-lived credential on demand removes the asset entirely.

That is why the maturity order is: get secrets out of source and configuration, into a vault, then replace vaulted static secrets with dynamic ones, then replace dynamic secrets with platform-attested workload identity wherever the runtime can vouch for the caller.

Why teams do not rotate

Ask why a credential has not been rotated in three years and the answer is almost never policy. It is that nobody is certain what breaks. That uncertainty is itself the finding: it means the secret has been copied rather than referenced, and its consumers are unknown. A single source of truth, references instead of copies and a tested rotation runbook matter more than the interval you choose.

Automation platforms are credential concentrators

Workflow and automation tools exist to hold connections to databases, repositories, cloud accounts, AI services and support platforms, which makes a single token for the orchestrator worth more than any credential it stores. With a leaked n8n API token, an attacker does not need to read a stored secret: they can build a workflow that uses the credential to call their own endpoint. The same reasoning applies to CI systems and to MCP servers brokering agent access.

Where to start

Read the best secrets management tools ranking and the top secrets management tools, then compare Doppler vs Infisical, AWS Secrets Manager vs HashiCorp Vault, Akeyless vs HashiCorp Vault and Vault vs Conjur. Browse all secrets management vendors and follow the API key rotation guide.