hq-secrets

You can manage CLI secrets with group-based access control by utilizing per-secret ACLs. This supports read, write, and admin permissions alongside group sharing for scalable access control across your organization.

You inject environment variables without leaking secret values by using explicit exec-based injection. This mechanism redacts values by default and requires exec workflows to safely run commands with secrets.

The safest way to share company secrets within a CLI environment is using dedicated share and unshare commands. This enforces safe usage patterns by applying per-secret ACLs and group-based access guardrails.

Yes, you can retrieve secret metadata without revealing the value by default. The system redacts values automatically, requiring an explicit reveal command to access the underlying secret data.

You handle human-provided credentials securely by using a generate-link flow. This human-centric approach allows users to input credentials safely while maintaining guardrails and auditing via ACLs and groups.

A limitation of exec-based secret injection is that it requires explicit execution to prevent leakage. You cannot simply export environment variables directly; workflows must adhere to this strict exec pattern to maintain security.