I deployed OneTimeSecret in a container, but I can't find clear documentation or built-in support for auditing shared secrets. I need to know what was issued, when it was accessed or expired, and possibly retain a record of the secret itself for compliance purposes. Are there better open-source, self-hosted alternatives, or is this functionality usually part of a broader privileged access management system?
3 Answers
This is usually handled as a feature of a full privileged access management platform rather than as a standalone one-time-secret service. If the existing tool already does most of what you need, extending it with the audit fields you require may be simpler than finding a perfect replacement. Keep in mind that storing the actual secret defeats much of the point of one-time sharing, so a safer audit trail normally records metadata such as who created it, when it was accessed, its recipient, and when it expired.
Password Pusher is another reasonable option. It can run in a self-hosted container, provides an audit log through its interface and API, and the core project is available under an open-source license. However, its audit records are generally about the push and its lifecycle, not a recoverable copy of the secret itself.
You may need to build that separately, but retaining plaintext secrets creates a major security risk. A better compromise is encrypted archival with strict access controls, key rotation, and a clear retention policy if compliance truly requires recoverability.
Bitwarden is open source and can be self-hosted, and its Send feature supports sharing sensitive text or files with expiration and access controls. It may be worth considering if you also want a password manager rather than a narrowly focused secret-sharing service.
That distinction is important. I’m specifically wondering whether any tool keeps a database record of the actual shared value, not just that a secret was created or viewed.