Show HN: Tresor – OIDC-based, role-scoped secrets for DuckDB

Category: security

Tags: duckdb, secrets-management, oidc, security, database-extension

Score: 6.5/10 (Innovation: 7, Technical: 7, Documentation: 6, Utility: 6)

Tresor is a DuckDB extension that integrates OIDC-based authentication and role-scoped secret management directly into DuckDB's secret lookup, eliminating the need for local secrets in notebooks and CI. It attaches a remote secrets service via the open duckdb-secrets/1 protocol, fetching only the secrets a user's roles permit, with short-lived credentials and audit logging. It fills a real gap for teams using DuckDB with corporate data sources.

Target audience: data engineers, backend developers, devops, security engineers

Repository: https://github.com/hugr-lab/tresor · C++ · MIT · 3 stars

View on Hacker News