I use pass as my general purpose personal secret management system. It synergizes very well with direnv, another one of my favorite tools. Using bash substituti

I use pass as my general purpose personal secret management system. It synergizes very well with direnv, another one of my favorite tools. Using bash substitution, you can set a per-directory environment variable to the output of a pass command. This way you never have to have unencrypted secrets sitting on your dev machine. I manage multiple machines, and while ssh-agent forwarding is easy to use, a lot of people don't know about gpg agent forwarding. It's a bit fiddly, but it allows you to store all your secrets encrypted on your remote machines and have your gpg agent sitting on your personal machine. I sorta wish it had different encryption backends, gpg is a bit long in the tooth. But it works just fine.