# Secrets Management

> Secrets handling. Never hardcode. Vault, env vars, rotation, leak detection.

- Skill: `aselimc/secrets-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aselimc/secrets-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aselimc/secrets-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aselimc (https://skillmd.com/u/aselimc)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/aselimc/secrets-management

---


# Secrets Management

## Rules
1. **Never** hardcode secrets in source code
2. **Never** commit `.env` files (add to `.gitignore`)
3. **Never** log secrets or include in error messages

## Local Development
```bash
# .env (in .gitignore)
DATABASE_URL=postgresql://user:pass@localhost:5432/db
API_KEY=sk-...
```
Load with `dotenv` (Python) or `dotenv` (Node).

## Production
- HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager
- Inject as environment variables at runtime
- Rotate credentials on schedule (90 days max)

## Leak Detection (CI)
```yaml
- name: Scan for secrets
  run: gitleaks detect --source . --verbose
```

## Key Libraries
vault, gitleaks, trufflehog, dotenv