I'm running OneTimeSecret in Docker, but I can't find clear documentation or functionality for auditing shared secrets. I'd like to know which secrets were issued, when they were created or accessed, and ideally whether the system can retain the secret contents for compliance purposes. Are there better open-source, self-hosted alternatives, or is this typically handled by a broader privileged access management platform?
3 Answers
Password Pusher is another good fit. It can run in a self-hosted container, has an audit log in the web interface and API, and the core functionality is available under an open-source license. It appears to track events around a pushed secret, but not necessarily the original secret contents.
Most secure one-time-secret systems intentionally avoid retaining plaintext after delivery. If content-level auditing is mandatory, you may need an enterprise PAM or a separate controlled secrets-management workflow, with the associated risk and access controls.
This is usually treated as a feature of a larger privileged access management system rather than a standalone one-time-secret tool. If OneTimeSecret already handles the sharing workflow you need, extending it with an audit trail may be more practical than switching products. Just keep in mind that storing the actual secret defeats some of the security benefits of one-time disclosure, so many systems log metadata—creator, recipient, timestamp, expiration, and access status—without retaining the plaintext.
Bitwarden is open source and can be self-hosted, and its Send feature supports sharing information that expires or can be accessed only a limited number of times. It may be worth considering if you also want password-vault features and centralized administration.
That distinction is important—I’m specifically wondering whether any tool keeps a record of what the shared secret actually was, rather than only recording that it was created or viewed.