0.18 release expands the secret lifecycle, adds four providers, and introduces a Swift SDK.
We have a new logo!
Declare, delete, and safely move secrets
Declare secrets without hand-editing the manifest:
$ secretspec add STRIPE_API_KEY --description "Stripe API access token"
✓ Added secret 'STRIPE_API_KEY' to profile 'default' in secretspec.toml
secretspec add preserves the manifest’s comments and formatting without asking for or storing a value. secretspec delete removes stored values while keeping their declarations.
Provider migrations can remove the source after proving the move succeeded:
secretspec import dotenv:~/.config/payments/.env --delete-source
SecretSpec verifies each destination value before deleting its source and leaves the source intact when conflicts occur.
Discover declarations from existing stores
secretspec init --from can now discover declarations from age files, AWS Parameter Store hierarchies, and scoped Bitwarden collections, in addition to dotenv. It writes names and generated descriptions to secretspec.toml, never values.
Four new providers
SecretSpec now supports 24 providers, including:
- Bitwarden Password Manager (
bw://): read, write, and discover vault items through thebwCLI. - Keeper Secrets Manager (
keeper://): batched reads, writes, deletion, and existing-record references. - AWS Parameter Store (
awsps://): KMS-encrypted parameters, versioned references, and bounded discovery. - Dashlane (
dashlane://): read-only secrets, secure notes, and logins throughdcli.
Swift SDK and provider authentication
The new Swift SDK brings the shared SecretSpec resolver to macOS 12+ on Intel and Apple silicon as a checksummed XCFramework.
Vault and OpenBao also gain custom AppRole and JWT mount paths,
dotenv paths accept ~,
and Linux keyring builds no longer require system libdbus.
Read the full announcement:
GitHub release:
Questions and feedback are welcome on Discord:
Disclaimer: LLMs have been used