Secrets Management
The practice of securely storing, distributing, and rotating sensitive data like API keys, passwords, database credentials, and certificates.
Definition
Secrets management addresses the challenge of keeping credentials secure throughout the development lifecycle. Key practices include: never committing secrets to git, using environment variables or secret managers (HashiCorp Vault, AWS Secrets Manager, 1Password), automatic rotation, audit logging, and least-privilege access. Modern CI/CD pipelines integrate with secret managers to inject credentials at runtime without exposing them in code or logs.
Why It Matters
Exposed secrets are a leading cause of security breaches. GitHub scans for exposed secrets and has prevented millions of credential leaks. According to GitGuardian, over 10 million secrets were exposed in public repositories in 2022. AI code reviewers like diffray detect hardcoded secrets before they're committed.
Example
Instead of hardcoding const API_KEY = "sk-12345" in source code, developers use process.env.API_KEY and configure the actual value in AWS Secrets Manager, which is accessed at runtime by the application.