Secrets Management
Rules
- Never hardcode secrets in source code
- Never commit
.envfiles (add to.gitignore) - Never log secrets or include in error messages
Local Development
# .env (in .gitignore)
DATABASE_URL=postgresql://user:pass@localhost:5432/db
API_KEY=sk-...
Load with dotenv (Python) or dotenv (Node).
Production
- HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager
- Inject as environment variables at runtime
- Rotate credentials on schedule (90 days max)
Leak Detection (CI)
- name: Scan for secrets
run: gitleaks detect --source . --verbose
Key Libraries
vault, gitleaks, trufflehog, dotenv