Lade

Lade is a lightweight command-line tool that automates loading secrets from your preferred vault into environment variables or files before executing a shell command, and securely clears them once the command completes. It is designed for developers and operators who need temporary, scoped access to credentials (API keys, database passwords, etc.) without leaving sensitive data lingering in shell history, process memory, or file systems. Integrating with vaults like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager, Lade retrieves the requested secrets, injects them into the shell environment, runs the user-specified command, and then explicitly removes those variables or files. This reduces the risk of accidental exposure in logs, screenshots, or subsequent commands. Lade is bundled with the Meta CLI and used transparently to provide secrets to Metatype typegates, but it is a standalone tool that can be used independently in any shell workflow. It supports multiple vault backends and configurable output formats (env vars or files). Its philosophy is minimal intervention: it does not persist secrets, does not run as a daemon, and leaves no trace after execution. What makes Lade different from similar tools (e.g., envconsul, vaulted) is its simplicity and focus on temporary injection without background processes. It is ideal for CI/CD pipelines, local development, and ad‑hoc administrative tasks where secrets should be visible only for the duration of a single command.