# values are read from stdin, never from the command line
secretsmgr put prod/stripe/api_key < newkey.txt
pwgen -s 40 1 | secretsmgr put prod/database/password
There is no --value flag, on purpose
Anything you type on a command line lands in your shell history and is visible to every other process on the machine while it runs. The tool rejects --value with an error explaining this rather than quietly accepting it.
Every write creates a new version rather than overwriting. Nothing is ever lost by accident, and secretsmgr describe will always tell you who changed a value and when.