secrets-tool update now fetches new versions from updates.sareba.com. You don't need to do anything: older versions are redirected there automatically. If your firewall only allows certain addresses, allow updates.sareba.com. The download page stays where it is.
If a deploy script reads values from secrets-tool and copies something to the clipboard anywhere, secrets-tool check now reports it – even when the two happen in different places of the script. Every program can read the clipboard, and its history keeps the values. The hint below tells you how to solve it with secrets-tool hostenv without the clipboard.
secrets-tool check checks your repository: is secrets.enc committed correctly, is something missing from .gitignore, is a value from secrets.enc, a private key or a token anywhere in plaintext? Every finding tells you right away what to do – never a value. With secrets-tool check --hook it runs before every commit, with --json in your CI.
secrets-tool hostenv writes the env files for your Docker containers onto the server – readable by root only, without any value showing up on screen, in the history or in the process list. Your deploy one-liners then only contain --env-file and a check that the file matches the current state. The docs explain how under “Getting env files onto the host”.
secrets-tool set NAME without a value now asks for it with hidden input. That way a password or token is neither in your command history nor in the process list.