git-crypt

git-crypt is a command-line tool for transparent encryption of sensitive files within a git repository — files matching a configured pattern are automatically encrypted before being committed and decrypted when checked out by someone with the key.

Unlike encrypting an entire repository, it works at the file level, so secrets, config files, or credentials can live in the same repo as the rest of the code while staying encrypted at rest on disk and in git history, decrypting transparently for anyone with access.

Common in teams that want secrets versioned alongside code changes without a separate secrets-management system, though many teams now prefer a dedicated secrets manager (Vault, AWS Secrets Manager) for anything beyond small teams.