SecretSpec is a declarative secrets manager for development workflows. Version 0.12 makes secret access accountable when a coding agent is doing the reaching:
- Audit log, on by default. Every read and write is appended to a local per-user JSONL log. Values are never recorded.
- Reason on access. Coding agents must now say why they need a secret before they get it.
- secretspec audit to filter and summarize the log, or pipe JSON Lines to jq.