sops Keeping Secrets in a Private Git Repo Without Actually Leaking Them secrets/db.enc.env is committed to a private GitHub repo, key names visible, values encrypted — and two independent age keys, one per machine, mean neither one alone has to be shared with the other.
