Manage Go application secrets with envelope encryption and AES-GCM.
npx skills add https://github.com/kaptinlin/gozod --skill go-secrets-managing
Please help me install this Agent Skill. Skill: go-secrets-managing Source: https://github.com/kaptinlin/gozod/tree/main/.agents/skills/go-secrets-managing Command: npx skills add https://github.com/kaptinlin/gozod --skill go-secrets-managing
Go projects often struggle to securely store and access credentials. This Skill provides a production-grade approach to managing secrets in Go, using envelope encryption and integration with go-config to load and interpolate sensitive values safely at startup and runtime.
Initialize the sample to securely load secrets using envelope encryption and integrate with go-config in your Go application.
High-intent search queries and answers about installing and using this skill.
Envelope encryption for Go secrets is implemented by deriving per-secret Data Encryption Keys (DEKs) and binding ciphertext to scope and name via Additional Authenticated Data (AAD) using AES-GCM. This ensures plaintext values stay isolated and protected at rest.
Memory-safety for Go secrets is achieved by zeroizing plaintext after use through Value.Close semantics, ensuring zero-memory exposure of sensitive values once they are no longer needed by the application.
Yes, encrypted secrets can be integrated with go-config by loading them as a config source or resolving ${secret:NAME} references during config parsing, allowing safe interpolation of sensitive values at startup and runtime.
Master key rotation in Go can be achieved with zero downtime by using multi-key rotation workflows, supporting envvar-based or KMS-backed master keys, and applying time-based rotation hooks for seamless upgrades.
You can audit secret access in Go by utilizing optional audit logging features that track provenance and record interactions with encrypted stores, satisfying security requirements for production-grade secret management.
Yes, this approach supports master-key management via environment variables or Key Management Service (KMS), allowing flexible deployment across different environments while maintaining secure envelope encryption.
giuseppe-trisciuoglioManage AWS KMS keys and encrypt data in Java 2.x applications.
xlelibertyManage HashiCorp Vault clusters and cloud-native secret stores.
kettleofketchupCentralize Go application configuration from files, environment variables, and defaults.
kubonyManage GCP Secret Manager secrets using gcloud CLI commands.
