Data and secrets
Manage application secrets
Keep credentials out of source code and logs, scope them narrowly, rotate them, and make local and production access deliberate.
8 minute lesson
API keys, signing keys, database passwords, and webhook secrets are credentials. Treat them as temporary authority, not configuration text.
Store production secrets in the platform secret manager, inject them only where needed, and never send them to browser code. Scope and rotate each secret independently. Plan what happens when one leaks before it happens.
One shared API key powers development, production, and a contractor script. Revoking it during an incident stops all three systems and makes the source of abuse unclear.
Separate secrets add rotation work. They also let us revoke one integration without turning a small leak into a full outage.
Inventory one production secret with owner, scope, consumers, and revocation command. Rotate it in a test environment, prove the new value works, and prove the old value fails.
Lesson completed