Secrets Management¶

Secrets (passwords, keys, tokens) require fundamentally different handling than code - they must never be stored in code, version control, or logs, and should be rotatable without code changes.

Tension Addressed¶

Convenience vs. Safety

Recognizable As¶

Environment variables for secrets; secret management services; encrypted secret storage; credential rotation policies; secrets not in git history; dynamic credential generation; short-lived tokens.

Canonical Sources¶

OWASP Secrets Management Cheat Sheet

Transfers To¶

Physical security (key management), cryptography (key lifecycle), personal security (password management), organizational security (access credential management)

Sub-concepts: - Secret rotation: The ability to change secrets without system modification reduces impact of compromise and limits temporal window of exposure - Least knowledge: Components should know only the secrets they need; centralized secret stores with scoped access