git-secret is a bash utility that encrypts sensitive files directly within your git repository using PGP encryption. Instead of managing separate secret vaults or environment variable systems, you can keep encrypted secrets alongside your code with fine-grained access control.

The tool works by encrypting files with the public keys of authorized users. Each team member can decrypt secrets using their own private key, making it simple to grant or revoke access without changing the actual secret values. When you need to remove someone's access, simply remove their key from the repository's keyring, re-encrypt the files, and they lose the ability to decrypt any secrets—no need to rotate passwords or regenerate credentials.

Key capabilities include:

Encrypt multiple files with a single command while tracking which files contain secrets
Manage team access by adding or removing users' PGP keys from the repository
Selective encryption with options to only re-encrypt modified files
Git integration that works seamlessly within your existing workflow
Cross-platform support via Homebrew, apt, yum, and manual installation

The tool requires bash 3.2.57+, git 1.8.3.1+, GPG (version 1.4 or 2.x), and standard utilities like gawk and sha256sum. It's particularly useful for teams that want to avoid external secret management services while maintaining strong encryption standards and clear audit trails through git history.