Secrets management
secrets vault · vault · API keys · hard-coded secrets · secret scanning · key rotation · gestion des secrets
The way technical passwords, API keys, tokens and certificates used by applications are stored, distributed and renewed, without ever writing them in plain text in the code.
In practice
A secret pasted into a configuration file sooner or later ends up in a Git repository, a container image or a screenshot, and it stays in the history even after deletion. Good practice is a secrets vault (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault and so on) that hands secrets out at runtime, with minimal rights and a record of every access. Secrets should be short-lived and rotated automatically. A secret-scanning tool, hooked into commits and CI, stops leaks before they are published.
Real case: in 2016, intruders used a cloud storage access key that an Uber engineer had posted on a code-sharing website. They downloaded unencrypted files containing, among other things, more than 25 million names and email addresses (source: FTC, 12 April 2018).
How to protect yourself
- Never write a secret in code or in any version-controlled file.
- Centralise secrets in a vault, with named and logged access.
- Scan commits and the full history of your repositories.
- If a secret leaks, revoke and replace it immediately, then clean up the history.
