# Secrets Management

> Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.

- Skill: `gabrielmoreira/secrets-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/secrets-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/secrets-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/gabrielmoreira/secrets-management

---


# Secrets Management

**Rules:**
1. **Never** hardcode secrets in source files, configs committed to git, or logs.
2. Use environment variables for local development (`python-dotenv`).
3. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password CLI) in production.
4. Add `.env` and `*.pem` to `.gitignore` before the first commit.
5. Rotate secrets immediately if they are exposed (leaked in a commit, log, or error message).

**Scanning:** Use `ggshield`, `truffleHog`, or `git-secrets` in CI to block secret commits.

**Anti-patterns:**
- `os.environ.get('KEY', 'hardcoded_default')` in production code.
- Logging full request/response bodies that may contain tokens.