I implemented a secrets manager using vim (which comes with blowfish file encryption support). We just pass the unlock key in from a secure location, such as our ci/cd pipeline, and then pass it to something like the following:

echo '1,$'|vim --cmd "set key=${__password}" ${__filename} -es|grep mysecret

Inside the file, you can do whatever programmatic syntax you want, because from here it's just shell pipelining.

I'd actually love to hear if this is a really bad idea.