envconsul VS encpass.sh

Might not perfectly fit but I think that was one of the ideas behind - https://github.com/hashicorp/envconsul (which can use Vault as a source), and probably to a degree consul-template (though a quick skim of the documentation and I'm not sure if can use Vault as a source.)

You have envchain to store secrets as ENV variables in your keyring and execute commands:

https://github.com/sorah/envchain

Not really something you would use for production web apps, I think envconsul covers that usecase:

https://github.com/hashicorp/envconsul

Have you looked into Hashicorp's consul + envconsul? You can also encrypt data using their vault.

https://github.com/plyint/encpass.sh/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz

The difficulties mentioned in the article with passing secrets on the command line is one of the reasons why we wrote encpass.sh (https://github.com/plyint/encpass.sh). We had a similar need for a lightweight solution for managing secrets for simple shell scripts on our local workstations and in restricted environments. Bonus, it can be easily customized with extension scripts to adapt functions for your own specific needs. See our keybase extension for an example -> https://github.com/plyint/encpass.sh/blob/master/extensions/...

We made an extension for encpass.sh that stores secrets in Keybase (https://github.com/plyint/encpass.sh/blob/master/extensions/...) if that sort of thing is of interest to you. Outside of personal secrets, it can be used as a sort of low cost stand in for shared secrets that you might use something like Vault for in a team environment.