Post

Another winter break coding side quest... I created a CLI tool called "burrow" for managing local secrets, inspired by `dotnet user-secrets`. But, it’s a standalone executable and it uses SQLite instead of JSON as the backing store. Check it out at safia.rocks/burrow/ 🐰

27/12/25, 5:09 pm9 reposts95 likes

Scott Wu

@scottwu.ca

29 Dec 2025

How's this compared to www.passwordstore.org

passwordstore.orgPass: The Standard Unix Password ManagerPass is the standard unix password manager, a lightweight password manager that uses GPG and Git for Linux, BSD, and Mac OS X.

Safia Abdalla

@captainsafia.com

29 Dec 2025

This is less a password management and more an application secrets manager. For example, storing database URLs and OAuth client ideas for a web app.

trivial_inanity

@thewisenerd.com

29 Dec 2025

nitpicking this cli pattern persists credentials on the shell history and is generally not recommended one of the other alternative approaches i've seen is something along the lines of: burrow add {name} enter value:{<stdin}

Safia Abdalla

@captainsafia.com

29 Dec 2025

This is a good feature request! I got another one about support “KEY VALUE” syntax in that command as well so the two can likely go together.

Robodobdob

@robodobdob.bsky.social

28 Dec 2025

So, you if it could read the user secrets I’d from the current project, burrow could run as a build task and export the secrets to the json path that user secrets expects?

Safia Abdalla

@captainsafia.com

28 Dec 2025

Yes, although I dunno what amount of massaging you’d be have to do to get the key format of the JSON file we currently export to work with user-secrets.