Secrets Management

Secrets handling. Never hardcode. Vault, env vars, rotation, leak detection.

aselimc Updated

File contents

Secrets Management

Rules

  1. Never hardcode secrets in source code
  2. Never commit .env files (add to .gitignore)
  3. Never log secrets or include in error messages

Local Development

# .env (in .gitignore)
DATABASE_URL=postgresql://user:pass@localhost:5432/db
API_KEY=sk-...

Load with dotenv (Python) or dotenv (Node).

Production

  • HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager
  • Inject as environment variables at runtime
  • Rotate credentials on schedule (90 days max)

Leak Detection (CI)

- name: Scan for secrets
  run: gitleaks detect --source . --verbose

Key Libraries

vault, gitleaks, trufflehog, dotenv

aselimc/agents_and_skills/tree/main/.claude/skills/secrets-management commit 3aec45ba3e

Frequently asked questions

npx skillmds@latest add aselimc/secrets-management