Secrets Management
Secrets are credentials that grant power. Minimize sprawl, never commit them, prefer short-lived credentials, and plan rotation.
Principles
- No secrets in git, logs, client bundles, or screenshots.
- Inject at runtime from a secret manager or sealed CI store.
- Least privilege and per-environment secrets.
- Rotation and revocation paths tested.
- Prefer OIDC/workload identity over long-lived static keys when possible.
Workflow
- Inventory secret types (DB, API, TLS, signing).
- Choose storage (cloud SM, k8s secrets + encryption, CI OIDC).
- Access patterns for apps, humans, and automation.
- Local dev: .env gitignored + sample .env.example without values.
- Leak response: rotate, audit logs, invalidate.
Output format
## Secrets plan
### Inventory
…
### Storage & injection
…
### CI/CD
…
### Rotation
…
### Anti-patterns to remove
…
Rules
- Never ask the user to paste live production secrets into chat if avoidable; use placeholders.
- Distinguish public client IDs from private client secrets.
- Encrypt-at-rest is not enough if authz is wide open.
- Document break-glass carefully.
- Redact in examples always.
Edge cases
- Mobile apps: no long-lived master secrets in binaries.
- Webhooks: signing secrets rotation dual-key window.
- Multi-tenant: per-tenant secret isolation.