Env & Secrets Manager
Manage environment-variable hygiene and secrets safety across local development and production workflows. Covers auditing, leak detection, rotation, and preventive controls.
What You Get
- Secret leak detection with regex-based scanning (staged files and git history)
- Severity-based findings (critical/high/medium) with response playbook
- Credential rotation workflows (AWS, Stripe, GitHub PAT, DB, JWT)
- Cloud secret store integration guidance (Vault, AWS SM, Azure KV, GCP SM)
- CI/CD secret injection patterns (GitHub Actions, GitLab CI)
- Pre-commit detection setup (gitleaks, detect-secrets)
When to Use
- Before pushing commits that touched env/config files
- During security audits and incident triage
- When onboarding contributors who need safe env conventions
- When validating that no obvious secrets are hardcoded
Recommended Workflow
- Scan the repository for likely secret leaks (see
references/secret-patterns.md)
- Prioritize
critical and high findings first
- Rotate real credentials and remove exposed values
- Update
.env.example and .gitignore as needed
- Add or tighten pre-commit/CI secret scanning gates
WRONG: secrets in code and examples
# WRONG: real credentials in .env.example
DATABASE_URL=postgres://admin:s3cret@prod.db.internal/myapp
STRIPE_SECRET_KEY=sk_live_abc123xyz
CORRECT: placeholders only
# CORRECT: .env.example with safe placeholders
DATABASE_URL=postgres://user:password@localhost/myapp_dev
STRIPE_SECRET_KEY=sk_test_REPLACE_ME
Common Pitfalls
| Mistake |
Why it's bad |
Committing real values in .env.example |
Example files get pushed; real secrets in git history |
| Rotating one system but missing downstream consumers |
Partial rotation causes outages |
| Logging secrets during debugging |
Logs persist in CI artifacts, observability platforms |
| Treating suspected leaks as low urgency |
Automated scrapers act within minutes of public exposure |
Using echo on secrets in CI pipelines |
Even with masking, secrets can leak via toJSON() or redirects |
Best Practices
- Use a secret manager as the production source of truth (never
.env in prod)
- Keep dev env files local and gitignored
- Enforce detection in CI before merge
- Re-test application paths immediately after credential rotation
- Commit only
.env.example, never .env
Reference Docs
| File |
Contents |
references/secret-patterns.md |
Detection regex by severity, response playbook |
references/rotation-and-detection.md |
Validation scripts, scanning tools, rotation workflow, pre-commit setup, cloud stores, CI/CD patterns |
Cloud Secret Store Quick Reference
| Provider |
Best For |
Key Feature |
| HashiCorp Vault |
Multi-cloud / hybrid |
Dynamic secrets, policy engine |
| AWS Secrets Manager |
AWS-native |
Lambda/ECS/EKS integration, auto RDS rotation |
| Azure Key Vault |
Azure-native |
Managed HSM, Azure AD RBAC |
| GCP Secret Manager |
GCP-native |
IAM-based access, versioning |
| 1Password |
Developer workflows |
CLI (op), Connect server, SSH agent |
Selection: Single cloud -> cloud-native store. Multi-cloud -> Vault. Developer/team -> 1Password or Doppler.
1---2name: env-secrets-manager3description: Environment variable hygiene, secret leak detection, and credential rotation workflows. TRIGGER when: working with .env files, secret management, credential rotation, pre-commit secret scanning, or investigating leaked credentials. DO NOT TRIGGER when: general config file editing, non-secret environment setup, or infrastructure provisioning (use relevant infra skill).4---56# Env & Secrets Manager78Manage environment-variable hygiene and secrets safety across local development and production workflows. Covers auditing, leak detection, rotation, and preventive controls.910## What You Get1112- Secret leak detection with regex-based scanning (staged files and git history)13- Severity-based findings (critical/high/medium) with response playbook14- Credential rotation workflows (AWS, Stripe, GitHub PAT, DB, JWT)15- Cloud secret store integration guidance (Vault, AWS SM, Azure KV, GCP SM)16- CI/CD secret injection patterns (GitHub Actions, GitLab CI)17- Pre-commit detection setup (gitleaks, detect-secrets)1819## When to Use2021- Before pushing commits that touched env/config files22- During security audits and incident triage23- When onboarding contributors who need safe env conventions24- When validating that no obvious secrets are hardcoded2526## Recommended Workflow27281. Scan the repository for likely secret leaks (see `references/secret-patterns.md`)292. Prioritize `critical` and `high` findings first303. Rotate real credentials and remove exposed values314. Update `.env.example` and `.gitignore` as needed325. Add or tighten pre-commit/CI secret scanning gates3334## WRONG: secrets in code and examples3536```bash37# WRONG: real credentials in .env.example38DATABASE_URL=postgres://admin:s3cret@prod.db.internal/myapp39STRIPE_SECRET_KEY=sk_live_abc123xyz40```4142## CORRECT: placeholders only4344```bash45# CORRECT: .env.example with safe placeholders46DATABASE_URL=postgres://user:password@localhost/myapp_dev47STRIPE_SECRET_KEY=sk_test_REPLACE_ME48```4950## Common Pitfalls5152| Mistake | Why it's bad |53| ------- | ------------ |54| Committing real values in `.env.example` | Example files get pushed; real secrets in git history |55| Rotating one system but missing downstream consumers | Partial rotation causes outages |56| Logging secrets during debugging | Logs persist in CI artifacts, observability platforms |57| Treating suspected leaks as low urgency | Automated scrapers act within minutes of public exposure |58| Using `echo` on secrets in CI pipelines | Even with masking, secrets can leak via `toJSON()` or redirects |5960## Best Practices61621. Use a secret manager as the production source of truth (never `.env` in prod)632. Keep dev env files local and gitignored643. Enforce detection in CI before merge654. Re-test application paths immediately after credential rotation665. Commit only `.env.example`, never `.env`6768## Reference Docs6970| File | Contents |71| ---- | -------- |72| `references/secret-patterns.md` | Detection regex by severity, response playbook |73| `references/rotation-and-detection.md` | Validation scripts, scanning tools, rotation workflow, pre-commit setup, cloud stores, CI/CD patterns |7475## Cloud Secret Store Quick Reference7677| Provider | Best For | Key Feature |78| -------- | -------- | ----------- |79| HashiCorp Vault | Multi-cloud / hybrid | Dynamic secrets, policy engine |80| AWS Secrets Manager | AWS-native | Lambda/ECS/EKS integration, auto RDS rotation |81| Azure Key Vault | Azure-native | Managed HSM, Azure AD RBAC |82| GCP Secret Manager | GCP-native | IAM-based access, versioning |83| 1Password | Developer workflows | CLI (`op`), Connect server, SSH agent |8485**Selection:** Single cloud -> cloud-native store. Multi-cloud -> Vault. Developer/team -> 1Password or Doppler.
DROOdotFOO