github.com/samuel-stidham/safetybox/v4

A single-user secrets manager for *nix. Versioned key/value vault: SQLite for metadata, age envelopes for values. Asymmetric by design, so writing secrets never requires the private key. Append-only versions for safe rotation, soft deletes, staleness tracking. One static Go binary. No server, no plaintext mode, no GUI.