EXTENSIONS

GPG-encrypted password store using the pass CLI (passwordstore.org). Can return just the first line of a multiline entry (the password, by pass convention) or a named metadata field such as login. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key and field names, and backend only — never secret values or error messages.

gopass password manager (gopass.pw) - pass compatible with extra features. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

SOPS + age vault for swamp: one encrypted file per secret.

Manage a Scaleway Key Manager (KMS) key — sync metadata, create, delete, rotate, list keys in a region, and encrypt/decrypt data, via the Key Manager API with X-Auth-Token auth. Plaintext is handled as sensitive and never logged or stored.

SOPS + age vault for swamp: encrypt secrets at rest with AES-256-GCM via Mozilla SOPS and age. Zero network dependency — fully local, file-based. Works with existing SOPS workflows and zo.space secrets dashboards.