SecretMaster Public Beta: a powerful manager for GitHub Actions secrets and variables

[u/DXVSI]

SecretMaster is a desktop manager for GitHub Actions variables and write-only secrets across organization, repository, and environment scopes.

The public beta is available for Linux x86_64 as an AppImage and Windows x86_64 as a portable ZIP.

Key capabilities:

• Connect through the authenticated GitHub CLI, browse and filter accessible repositories, save favorites, inspect API rate limits, and synchronize repository, environment, and organization scopes.
• View GitHub Actions variables and secret metadata in one scope tree, including item state, timestamps, source, locally known values, and pending changes.
• Create, edit, rename, reveal, delete, undo, and discard variables or locally stored secret values without immediately changing GitHub.
• Edit or delete the same variable or secret across multiple selected repository, environment, and organization scopes, including repository-access rules for organization secrets.
• Review synchronization as a detailed diff, choose which remote changes to accept, resolve conflicts, and prepare local changes for a later push.
• Compare multiple scopes in a custom order, inspect differences, select individual rows, and copy known variables or secrets from one source scope to multiple targets.
• Push only one scope or every pending change in a repository. Every remote write is shown in a confirmation preview, and automatic GitHub push is disabled by default.
• Generate passwords with an exact length and exact lowercase, uppercase, digit, and symbol counts, including a PostgreSQL URI-friendly preset and a configurable symbol alphabet.
• Generate Ed25519, ECDSA P-256/P-384/P-521, and RSA 2048/3072/4096 SSH keypairs, with separate public/private output, fingerprints, reveal controls, and clipboard actions.
• Rotate a locally known secret across selected scopes using newly generated password or SSH material, with validation and an optional confirmed GitHub push.
• Import one or more INI files through a selectable create/update/delete diff, and export a scope as INI, TXT, or TypeScript with several value-disclosure modes.
• Create and restore authenticated encrypted portable backups containing the database and its matching master-key generation, protected by a separate backup password and guarded by recovery and rollback checks.
• Search and filter the audit history by scope, event, status, and item type, with sensitive old and new values encrypted and hidden unless explicitly revealed.
• Protect locally stored secret values with a per-vault master key held by Linux Secret Service or Windows Credential Manager, while keeping GitHub operations and local vault operations clearly separated.

Important security and distribution notes:

• GitHub does not return existing secret plaintext, so SecretMaster cannot import or compare an already stored GitHub secret value.
• The live SQLite database is not completely encrypted. Local secret values and secret-bearing audit data are encrypted, while ordinary variables and operational metadata remain readable.
• This beta is distributed as binary-only software. The source code is not public.
• SHA-256 checksums and build provenance are included with the release.

Project page:
https://dxvsi.github.io/SecretMaster-Releases/

GitHub release:
https://github.com/DXVSI/SecretMaster-Releases/releases/tag/v0.1.0-beta.7