Command Palette
Search for a command to run...
Comments
Join the discussionNo comments yet. Be the first to comment.
Search for a command to run...
No comments yet. Be the first to comment.
If you've ever spent a Friday evening debugging why your production app can't find its database credentials, or watched in horror as a simple cloud migration turned into a three-month engineering project, this post is for you.
Let's be honest about the current state of secret and configuration management:
It's a complete mess.
Every cloud provider has their own way of doing things:
AWS has Secrets Manager ($0.40/secret/month) AND Parameter Store (cheaper but limited)
Google Cloud has Secret Manager with its own API
Azure has Key Vault with yet another interface
Kubernetes has ConfigMaps and Secrets with base64 "encryption" (yes, really)
And don't get me started on HashiCorp Vault's learning curve
The result? Your codebase becomes a Frankenstein monster of provider-specific SDKs, each with their own:
Authentication methods
API patterns
Error handling
Rate limits
Pricing models
Security considerations
# This is what your code looks like today (be honest)
if env == "aws":
client = boto3.client('secretsmanager')
response = client.get_secret_value(SecretId=name)
return json.loads(response['SecretString'])
elif env == "gcp":
client = secretmanager.SecretManagerServiceClient()
name = f"projects/{project}/secrets/{secret_id}/versions/latest"
response = client.access_secret_version(request={"name": name})
return response.payload.data.decode("UTF-8")
elif env == "local":
# TODO: fix this before Monday's demo
return os.environ.get(name, "default_value")
else:
# Karen from DevOps said she'd handle this
raise NotImplementedError("Good luck!")
This isn't just ugly code. It's expensive, risky, and soul-crushing:
Companies routinely overpay by 70% because they store ALL values as "secrets" (at $0.40/month each) instead of using cheaper parameter stores for non-sensitive configs. That's thousands of dollars annually for no good reason.
Want to move from AWS to GCP? That "simple" migration just became a 3-month project requiring changes to every service, new deployment pipelines, and extensive testing. We've seen companies literally stay with inferior cloud providers because migration is too painful.
When secret management is hard, developers take shortcuts. Environment variables in Docker images, secrets in git history, shared credentials across environments - we've all seen it, and we've all done it when under pressure.
Your engineers didn't sign up to become experts in five different secret management systems. They want to build features, not maintain abstraction layers for basic infrastructure needs.
AnySecret solves this with a radically simple approach:
import anysecret
# This works EVERYWHERE - AWS, GCP, Azure, K8s, local development
database_password = anysecret.get("database_password")
api_key = anysecret.get("stripe_api_key")
feature_flags = anysecret.get("feature_flags")
That's it. Same code whether you're:
Developing locally with .env files
Running in AWS with Secrets Manager
Deployed on GCP with Secret Manager
Operating in Kubernetes with native secrets
Testing in CI/CD pipelines
AnySecret automatically detects your environment and uses the appropriate backend. No configuration needed - it just works.
We automatically separate secrets from configurations, routing them to the most cost-effective storage. Passwords go to secure vaults, while feature flags use cheaper parameter stores. This alone saves most companies 60-70% on their secret management costs.
Need to move clouds? Change one environment variable, and AnySecret handles the rest. You can even run multi-cloud with different services using different providers.
End-to-end encryption for sensitive values
Automatic secret rotation support
Audit logging across all providers
Principle of least privilege by default
We believe infrastructure tools MUST be open source. Here's why:
You're trusting us with your most sensitive data. Our code is 100% auditable. Every line, every commit, every security decision is public. You can (and should) verify that we're not doing anything sketchy.
The whole point of AnySecret is to prevent lock-in. Making it proprietary would be hypocritical and defeat the purpose. You can fork it, modify it, or walk away anytime.
The best features come from real users solving real problems. Our community has contributed provider integrations, security improvements, and use cases we never imagined.
We chose AGPL-3.0 with a dual-licensing model. Here's why this matters:
✅ Internal tools and applications
✅ Open source projects
✅ Personal projects
✅ Startups and small businesses (< $100K ARR)
✅ Non-profits and educational institutions
If you're making money with AnySecret in production, we ask you to contribute back:
Commercial License: $2,000/year for businesses
Enterprise License: Custom pricing for SaaS platforms and large deployments
This isn't about getting rich. It's about sustainability. The license fees fund:
🔐 Security audits and fixes
🚀 New provider integrations
📚 Documentation and support
🐛 Bug fixes and maintenance
💡 Feature development
Without sustainable funding, open source projects die. We've all seen great tools abandoned because maintainers burned out or couldn't afford to continue. We're determined not to be another cautionary tale.
Write secret management code once. Deploy anywhere. Stop wasting time on boilerplate and focus on building features.
Manage secrets consistently across all environments. Implement security policies once. Sleep better at night.
Save 60-70% on secret management costs. Migrate clouds without rewriting applications. Reduce security risks with proper secret handling.
A sustainable open source project that will be here for the long haul. Your contributions matter and will be maintained.
# Install
pip install anysecret-io
# Use it
import anysecret
secret = anysecret.get("my_secret")
# That's literally it
No configuration files. No initialization. No setup wizards. It just works.
We're just getting started. Here's what's coming:
More Providers: Oracle Cloud, DigitalOcean, Cloudflare Workers
Secret Rotation: Automatic rotation with zero downtime
Policy Engine: Define rules once, enforce everywhere
Audit Dashboard: Single pane of glass for all secret access
We're building AnySecret in the open, with the community, for the community.
We built AnySecret because we were tired of solving the same problem over and over again at every company we worked at. We were tired of weekend emergencies because someone forgot to update a secret. We were tired of choosing cloud providers based on lock-in rather than features.
Most importantly, we were tired of security being hard. When security is hard, people don't do it. When people don't do it, bad things happen.
AnySecret makes security easy. And when security is easy, everyone wins.
Welcome to the future of secret management. Welcome to AnySecret.
P.S. - Yes, we know "yet another secret manager" sounds like an XKCD comic. But sometimes the problem isn't too many standards - it's that none of them talk to each other. AnySecret isn't another standard; it's the translator that makes all the existing standards work together.
Ready to eliminate secret management pain forever?
Get started with AnySecret →
Questions? Concerns? Just want to chat?
Reach out at hello@anysecret.io or @anysecret_io