Guides to keeping team secrets
Long reads on the questions teams run into with secrets: how to share env files, what to change when someone leaves, how CI should sign in, how to keep keys away from AI coding agents, whether to self-host, and who can decrypt your values.
About these guides: 7 guidesSources last checked October 30, 2026
Six topics, one guide each
Every guide answers its main question in the first lines, then goes deep: methods side by side, steps, checklists, common questions and sources. Pages on the same topic are listed at the end of each guide.
Sharing .env files
How to share .env files with your team securely
Five ways teams share .env files, compared by who can read the values and what happens when someone leaves, plus a setup that keeps env files out of chat.
49 pages on this topic·15 min read
Offboarding
What to rotate when a developer leaves
When a developer leaves, access ends but the secrets they saw keep working. The order to work in, what to rotate first, and how to reissue without downtime.
41 pages on this topic·14 min read
CI and OIDC
CI/CD secrets with OIDC: GitHub, GitLab, Bitbucket
How CI jobs reach AWS, Google Cloud, Azure and your vault with short-lived OIDC tokens instead of stored keys, and which claims to pin so a leaked token fails.
22 pages on this topic·15 min read
AI coding agents
Keep secrets away from AI coding agents
AI coding agents read files and run commands with your permissions. How to keep .env values out of their reach in Claude Code, Cursor and GitHub Copilot.
6 pages on this topic·15 min read
Self-hosting
Self-hosted secrets manager: options and trade-offs
What you actually run when you self-host a secrets vault: Vault, OpenBao, Infisical, Bitwarden, Phase and Crunu compared by components, keys and backups.
12 pages on this topic·15 min read
Who can decrypt
Who can decrypt your secrets? 18 tools compared
Which secrets managers decrypt on their own servers and which only on your devices: 18 tools compared, quoting each vendor's documentation, with the trade-offs.
45 pages on this topic·14 min read
Roundup45 pages on this topic · 14 min read
Choosing a tool
Our pick of secrets managers for teams of 2 to 50, sorted by the kind of team each one suits, with the criteria written down.
Best secrets managers for small teams (2026)
Secrets managers for teams of 2 to 50, picked by use case with open criteria: who can decrypt, what you run, CI sign-in, offboarding and cost model.
Written by Crunu, which makes one of the products on the list.
How these guides are written
Facts about other products come from their own documentation, pricing pages and source repositories. Each guide lists its sources at the end, with the date we last checked each one.
Crunu makes a secrets manager, so the guides say where it fits and where it does not. The practices they describe work with any tool, including no tool at all.
Examples use Kiteline, a fictional company. If something is out of date or wrong, write to support@crunu.com.
Try it with one project
Free during early access. Sign up with your email; your account keys and Secret Key are created in your browser, and the server never sees them.