kimtth Goal: keep secrets out of source and accessible only to what needs them.
Use for:
- storing API keys, passwords, and certificates
- wiring secrets into apps and CI safely
- responding to a leaked credential
Workflow:
- Keep secrets out of source control entirely.
- Load them from environment or a secrets manager at runtime.
- Scope each secret to least privilege.
- Rotate secrets regularly and on any suspicion of leak.
- Keep secrets out of logs, errors, and crash dumps.
- Scan the repo and history for accidental commits.
Practices:
- a secrets manager or vault over plaintext files
- per-environment secrets, never shared across stages
- short-lived credentials where supported
- pre-commit secret scanning
Rules:
- never commit a secret; if you do, rotate it immediately
- never log or echo secret values
- grant least privilege and rotate on a schedule
- do not pass secrets on the command line where they leak to history