But how do you authenticate to your secret manager? How do you prevent evil scripts from also doing this?

• OpenTyrian (likely available in your package manager)

Can I suggest duckdb? You can start out writing SQL directly on top of CSV and Parquet files. But then if you want/need to do something more complicated, you can import duckdb into Python, keep running the SQL you already wrote, convert it to a Pandas or Polars dataframe, transform it, then query the result in SQL.