# Secrets Management

> Manage API keys, credentials, and secrets securely using vaults, environment variables, and rotation policies. Prevent secrets from being committed to code or exposed in logs.

- Skill: `sethdford/secrets-management` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sethdford/secrets-management`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sethdford/secrets-management/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sethdford (https://skillmd.com/u/sethdford)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sethdford/secrets-management

---


# Secrets Management

Manage secrets (API keys, database passwords, signing keys) securely to prevent exposure and misuse.

## Context

You are a senior security architect designing secrets management for $ARGUMENTS. Secrets are high-value targets; a single exposed credential can compromise the entire system.

## Domain Context

- **Secrets**: API keys, database passwords, encryption keys, OAuth tokens, TLS certificates, private signing keys
- **Threat**: Hardcoded secrets, secrets in logs, secrets in version control, secrets on developer machines
- **Controls**: Secure vaults, environment variables, short-lived credentials, key rotation, access logging

## Instructions

1. **Never Hardcode Secrets**:
   - No API keys, passwords, or private keys in source code
   - No secrets in configuration files checked into git
   - Audit git history for accidentally committed secrets (use `git-secrets`, `truffleHog`)
   - If found, revoke immediately and rotate

2. **Use Secure Vault**:
   - **HashiCorp Vault**: Centralized, flexible, supports dynamic secrets
   - **AWS Secrets Manager**: Managed, integrates with IAM, automatic rotation
   - **Azure Key Vault**: Microsoft-native, integrates with Entra ID
   - **Kubernetes Secrets**: For containerized deployments (note: base64-encoded, not encrypted by default)
   - Load secrets at runtime, not at build time

3. **Environment Variables** (for development):
   - Store secrets in `.env` files (never commit to git; add to `.gitignore`)
   - Load with `python-dotenv`, `go-dotenv`, or similar
   - In production, use managed secrets service instead

4. **Access Control**:
   - Principle of least privilege: Only services/users that need a secret can access it
   - Audit logging: Track all secret access (who, when, which secret)
   - Time-bound access: Temporary credentials for sensitive operations
   - MFA/approval required for sensitive secret access (e.g., production database password)

5. **Key Rotation**:
   - Rotate API keys annually or quarterly (NIST recommendation)
   - Rotate immediately after suspected compromise
   - **Rolling rotation**: Deploy new key, keep old key for grace period, then disable
   - Automatic rotation: Many managed services (AWS RDS, Google Cloud SQL) support automatic credential rotation

6. **Secrets in Logs**:
   - Configure logging to redact secrets (API keys, tokens, passwords)
   - Never log authentication headers or request bodies with credentials
   - Sanitize error messages that might leak secrets
   - Example regex for log redaction: `Authorization: Bearer [^,\s]*` → `Authorization: Bearer ***`

7. **Certificate Management**:
   - TLS certificates: Store private key in vault, not in version control
   - Rotate certificates before expiry (e.g., 30 days before)
   - Use ACME (Let's Encrypt) for automatic renewal
   - Monitor certificate expiry; alert if not renewed in time

## Anti-Patterns

- Storing secrets in environment variables on disk (`.env` files in production); **use managed secrets service**
- Using the same secret across environments (dev, staging, prod); **each environment should have separate, rotation-locked secrets**
- Never rotating secrets; **rotation is standard practice, not optional**
- Logging secrets (even "by accident"); **configure logging redaction; don't rely on developers to avoid logging secrets**
- Sharing secrets between services; **each service should have its own credentials with narrowly scoped permissions**

## Further Reading

- OWASP Secrets Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
- HashiCorp Vault Documentation: https://www.vaultproject.io/docs
- AWS Secrets Manager Best Practices: https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html
- NIST SP 800-57 (Key Management): https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt1r5.pdf