SOPS (Mozilla / CNCF) — #3 Alternative to HashiCorp Vault
Git-committed encrypted YAML, JSON, ENV, and INI files backed by age or Cloud KMS
Encrypts only secret values while leaving YAML/JSON keys in cleartext so engineers can review clean `git diff` PRs without running any secrets server at all.
License: MPL-2.0 · Pricing: Free & Open Source · Compare all HashiCorp Vault alternatives · Official Website