GitHub Actions secrets manager
One powerful manager for GitHub Actions secrets
Inventory variables and secret metadata across repositories, environments and organizations. Generate passwords or SSH keys, replace one secret across selected scopes, and push to GitHub only after explicit confirmation.
01
Control every supported scope
- Inventory
- See GitHub variables and secret metadata across repository, environment and organization scopes.
- Generate
- Create exact-category passwords or Ed25519, ECDSA and RSA SSH keypairs without putting private material in process arguments.
- Generate and replace
- Apply one replacement atomically to selected local scopes. Optional GitHub push is off by default and targets only that confirmed plan.
- Move safely
- Create a portable authenticated encrypted backup containing the database and its matching vault key generation.
02
Clear security boundaries
GitHub does not return secret plaintext, so no desktop client can import an existing GitHub secret or prove its value by reading it back. SecretMaster verifies local encryption, database lineage and GitHub acceptance metadata instead.
Secret values and secret-bearing audit fields in the live SQLite database are encrypted; ordinary variables and metadata are not. Portable backups encrypt the complete archive.
The operation called rotation does not change a PostgreSQL account, install an SSH public key or revoke an external credential. Provider-specific rotation requires a provider adapter and remains outside this beta.