{"slug": "sops", "name": "sops", "category": "other", "category_name": "Other software", "description": "", "recommenders": 3, "commenters": 3, "warners": 0, "score": 2.706, "rising": 0.35, "first": "2026-01-15", "latest": "2026-09-18", "why": "It would be nice to use something like SOPS[1] + age right from the start", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 0, "warn": 0}, "spark": [0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "It would be nice to use something like SOPS[1] + age right from the start", "icon": true, "domain": null, "github_repo": "github.com/getsops/sops", "official_url": "https://getsops.io", "pricing": "", "aliases": ["sops", "SOPS"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 796120656, "item_id": 49757541, "url": "https://news.ycombinator.com/item?id=49757541", "by": "thehamkercat", "date": "2026-09-18", "stance": "recommend", "quote": "i use sops", "excerpt": "i use sops Encrypt: sops encrypt --input-type dotenv --output-type dotenv .env > secrets.enc.env then rm .env You can then run your script/dev with: sops exec-env secrets.enc.env 'docker xxxx' (it will ask you for your password, or touch-id to decrypt the secrets) I like this because this way the .env doesn't sit in the directory at all, and is only passed to your dev environment and stays in it while it's running De", "context": "", "use_case": "encrypting .env secrets", "switched_from": "", "story": "Inside ZCode: Silently uploading your Git history to the cloud"}, {"id": 771031552, "item_id": 48189472, "url": "https://news.ycombinator.com/item?id=48189472", "by": "epistasis", "date": "2026-05-18", "stance": "recommend", "quote": "It would be nice to use something like SOPS[1] + age right from the start", "excerpt": "Great timing, I was just getting frustrated about this today. I've got a pyinfra secrets.py and another project with an .env for logins for grabbing and moving data. I use LLMs on both of them extensively (having an LLM setup all my proxmox VMs and LXC containers and configure them without doing that yak shaving has been amazing.) It would be nice to use something like SOPS[1] + age right from the start, so I don't f", "context": "", "use_case": "secrets management", "switched_from": "", "story": "Sieve \u2013 scans Cursor/Claude chat history for leaked API keys"}, {"id": 746148144, "item_id": 46634259, "url": "https://news.ycombinator.com/item?id=46634259", "by": "geoffeg", "date": "2026-01-15", "stance": "recommend", "quote": "I use sops and age", "excerpt": "I use sops and age, originally loosely based on this article: https://devops.datenkollektiv.de/using-sops-with-age-and-git-like-a-pro.html I originally set up the git filters, but later disabled them.", "context": "", "use_case": "keeping .env secrets encrypted in git", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["encrypting .env secrets", "secrets management", "keeping .env secrets encrypted in git"], "compared": [{"slug": "age", "name": "age", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49750694", "title": "Inside ZCode: Silently uploading your Git history to the cloud", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48188727", "title": "Sieve \u2013 scans Cursor/Claude chat history for leaked API keys", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46626836", "title": "Bubblewrap: A nimble way to prevent agents from accessing your .env files", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 1}, "2026-10": {}}, "quotes": [{"id": 796120656, "item_id": 49757541, "url": "https://news.ycombinator.com/item?id=49757541", "by": "thehamkercat", "date": "2026-09-18", "stance": "recommend", "quote": "i use sops", "excerpt": "i use sops Encrypt: sops encrypt --input-type dotenv --output-type dotenv .env > secrets.enc.env then rm .env You can then run your script/dev with: sops exec-env secrets.enc.env 'docker xxxx' (it will ask you for your password, or touch-id to decrypt the secrets) I like this because this way the .env doesn't sit in the directory at all, and is only passed to your dev environment and stays in it while it's running De", "context": "", "use_case": "encrypting .env secrets", "switched_from": "", "story": "Inside ZCode: Silently uploading your Git history to the cloud"}, {"id": 771031552, "item_id": 48189472, "url": "https://news.ycombinator.com/item?id=48189472", "by": "epistasis", "date": "2026-05-18", "stance": "recommend", "quote": "It would be nice to use something like SOPS[1] + age right from the start", "excerpt": "Great timing, I was just getting frustrated about this today. I've got a pyinfra secrets.py and another project with an .env for logins for grabbing and moving data. I use LLMs on both of them extensively (having an LLM setup all my proxmox VMs and LXC containers and configure them without doing that yak shaving has been amazing.) It would be nice to use something like SOPS[1] + age right from the start, so I don't f", "context": "", "use_case": "secrets management", "switched_from": "", "story": "Sieve \u2013 scans Cursor/Claude chat history for leaked API keys"}, {"id": 746148144, "item_id": 46634259, "url": "https://news.ycombinator.com/item?id=46634259", "by": "geoffeg", "date": "2026-01-15", "stance": "recommend", "quote": "I use sops and age", "excerpt": "I use sops and age, originally loosely based on this article: https://devops.datenkollektiv.de/using-sops-with-age-and-git-like-a-pro.html I originally set up the git filters, but later disabled them.", "context": "", "use_case": "keeping .env secrets encrypted in git", "switched_from": "", "story": "Bubblewrap: A nimble way to prevent agents from accessing your .env files"}]}