rosec launched reading from Bitwarden, which is the case I built it for. But tying your whole Secret Service to a cloud account isn't for everyone, and "read my secrets from somewhere else" shouldn't require a somewhere-else.
So rosec now has a provider of its own: a local encrypted vault. Secrets live encrypted on your own disk, and the daemon serves them on the bus exactly like any other backend; secret-tool and friends can't tell the difference. It's the answer for anyone who wants the multi-provider Secret Service without a remote dependency in the loop.
The piece that makes it pleasant is PAM unlock, which landed alongside it: log in once and the vault opens with your login password, so there's no second prompt before your first secret lookup of the session.
rosec provider add local
rosec unlock
rosec item add --provider local --label "GitHub" --attr username=alice --secret 'hunter2'
secret-tool lookup label "GitHub" # → hunter2, from your own disk
This is the provider I'd reach for first now: Bitwarden when I want sync, the local vault when I want nothing leaving the machine. More backends still to come.