open-kms VS SecureStore

It sounds like you are talking about something that abstracts the users table. I would look at products like Basis Theory and their competitors. https://basistheory.com/

Couple of random notes:

* Some environments might be able to use a structure where a PII table is fully tokenized while less-sensitive data is more broadly available to developers.

* Postgres can be configured with row/column-level security.

* I believe https://basistheory.com/ offers the per-user/entity key setup. This is an additional service/cost but the UI is slick and easy to provision/remove access to specific fields.

Have you looked into NeoSmart's SecureStore? It uses a versionable json file with encrypted strings as secrets, and can be unlocked via a password or a keyfile that you deploy to your application. I've used it before, and it's pretty easy to use and implement. https://github.com/neosmart/SecureStore

A similar but actually secure alternative to user secrets in-prod is using SecureStore: https://github.com/neosmart/SecureStore

Have you looked into SecureStore (https://github.com/neosmart/SecureStore) for managing secrets? You can commit the json file to git, but you keep the key separate.

I tend to use secure store for this. https://github.com/neosmart/SecureStore. json file hold the encrypted stuff and I use a key file that goes out with deployment but never checked in. I can think of a thousand holes for all solutions. Most fall on how to you protect the key or the environment. At that point all is lost.