A command-line interface for HashiCorp Vault that simplifies secret generation, management, and secure credential handling.
Safe is a command-line interface for HashiCorp Vault that enhances secret management with secure generation of SSH/RSA keys, random passwords, and streamlined credential operations. It solves problems like securely providing credentials without files, auto-generating passwords, and managing multiple Vault paths efficiently, especially for BOSH deployments using Spruce.
DevOps engineers, platform operators, and security professionals who use HashiCorp Vault for secret management and need enhanced CLI tools for secure credential generation and automation.
Developers choose Safe over the standard Vault CLI for its specialized features like interactive password entry, credential formatting, and X.509 certificate management, which simplify secure workflows and reduce the risk of credential exposure.
A Vault CLI
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Generates SSH and RSA key pairs directly within Vault without local file exposure, as shown with the 'ssh' and 'rsa' subcommands, reducing credential leakage risks.
Provides double-confirmation prompts for sensitive inputs without writing to disk, enhancing security during manual password entry, as described in the 'set' command usage.
Supports reformatting passwords into base64, bcrypt, or crypt-sha512 hashes and storing them as new keys via 'safe fmt', useful for system integrations like htpass files.
Allows chaining commands with '--' and additive updates to multiple paths, streamlining complex workflows, such as generating keys and setting metadata in one go.
Offers tools to issue, revoke, validate, and renew TLS/SSL certificates through the 'x509' subcommands, integrating certificate lifecycle management directly with Vault.
Only supports token, LDAP, GitHub, and Okta backends, missing other Vault authentication methods like AWS or Azure, as admitted in the README under 'Authentication'.
The Homebrew formula in core is outdated and incorrect, forcing MacOS users to rely on a custom tap, which adds setup complexity and potential maintenance issues.
Lacks a graphical user interface, making it less accessible for non-technical users or teams preferring visual tools for secret management and auditing.
Exports are not encrypted and storing them on-disk is discouraged due to credential leakage risks, as noted in the 'import' command documentation, requiring careful handling.