Env Secrets Manager

Env & Secrets Manager

Complete environment variable and secrets management lifecycle: .env file structure across dev/staging/production, .env.example auto-generation that strips sensitive values, required-variable validation at startup, secret leak detection in git history, credential rotation playbooks, environment drift detection, and integration with HashiCorp Vault, AWS SSM, 1Password CLI, and Doppler.

Core Capabilities

• .env lifecycle — structured layout with categorized sections, auto-generated .env.example (strips secrets), environment-specific files, and fail-fast startup validation.
• Secret leak detection — regex scan of git history, working tree, and staged files; pre-commit hooks; patterns for API keys, tokens, passwords, private keys.
• Credential rotation — per-secret playbooks, scope analysis, zero-downtime dual-read rotation, post-rotation verification and monitoring.
• Secret manager integration — HashiCorp Vault (KV v2 + OIDC), AWS SSM Parameter Store (KMS), 1Password CLI (template injection), Doppler (project/config).
• Drift detection — compare variable key sets between staging and production and report missing/extra keys.

When to Use

• Setting up a new project — scaffold .env.example and validation.
• Before every commit — scan for accidentally staged secrets.
• Post-incident — rotate leaked credentials systematically.
• Onboarding developers — provide complete environment setup.
• Auditing — detect environment drift between staging and production.
• Compliance — demonstrate secret management practices.

Clarify First

Before running, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Task — scaffold/validate a .env, scan for leaked secrets, or check env drift (selects env_validator.py vs secret_scanner.py vs env_sync_checker.py)
• Target paths — the .env/.env.example files or directory to scan (the input the tools read)
• Secret manager — Vault, AWS SSM, 1Password, or Doppler (determines the integration and rotation commands generated)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Tools

References

Load the reference that matches the task — keep this file lean and pull detail on demand:

• references/env-file-structure.md — canonical .env layout, the .env.* file hierarchy, required .gitignore patterns, and the full Python startup-validation script. Read when scaffolding a project or wiring validation.
• references/leak-detection-and-rotation.md — the git-history secret scanner, pre-commit hook, the 4-step credential rotation playbook (scope, generate, dual-write, verify), and the environment-drift detection script. Read when scanning for leaks or rotating credentials.
• references/secret-manager-integration.md — concrete Vault, AWS SSM, and Doppler commands for storing, reading, and rotating secrets. Read when integrating a secret manager.
• references/best-practices-and-troubleshooting.md — common pitfalls, the 8 best practices, the troubleshooting table, and the success-criteria bar. Read when reviewing a setup or debugging.

Scope & Limitations

This skill covers:

• .env file scaffolding, hierarchy, and validation for any language/framework
• Secret leak detection in git history, staged files, and working tree
• Credential rotation playbooks with zero-downtime dual-read strategy
• Integration patterns for HashiCorp Vault, AWS SSM, 1Password CLI, and Doppler

This skill does NOT cover:

• Runtime secret injection in Kubernetes (see engineering/ci-cd-pipeline-builder for deployment pipeline secrets)
• Infrastructure-as-code for provisioning Vault clusters or SSM policies (see engineering/ci-cd-pipeline-builder)
• Application-level encryption at rest or in transit (see engineering/api-design-reviewer for API security patterns)
• Identity and access management (IAM) role design or SSO/OIDC provider configuration (see ra-qm-team/ compliance skills for access control frameworks)

Integration Points