saranskumar Goal
Ensure secret handling is safe across local, CI, staging, production, and serverless environments.
When to Use
- A system depends on external providers or privileged credentials.
- Environment configuration or deployment setup is being designed.
- A review is needed for secret exposure risk.
Instructions
- Inventory the secrets and their trust requirements.
- Identify where each secret is stored, loaded, and used.
- Verify no privileged credentials leak into client code or untrusted runtimes.
- Recommend safer loading, scoping, and rotation practices.
Constraints
- Never normalize secrets in source code.
- Do not let service-role or admin credentials flow into the client.
- Keep environment-specific differences explicit.
Output Format
- secret inventory
- trust mapping
- risks
- remediation steps
Examples
- "Review how we handle env vars across local and prod."
- "Where should these service credentials live?"