Secrets management

Every running system holds credentials it did not choose: a database password, a payment provider’s live key, a mail service token, a cloud account. Secrets management is the answer to four questions about them. Where do they live, how do they reach the code that needs them, how do they get changed, and how quickly can they be cancelled.

The default answer for a young product is a file of environment variables copied between laptops, which fails on the fourth question. A leaked key is a problem for exactly as long as it stays valid, so the ability to revoke and reissue in minutes matters more than the strength of the key itself.

The recurring failure is the credential in version control. Once a secret is committed it exists in the repository’s history permanently, and deleting the file does not remove it. Public repositories are scanned continuously by automated tooling, and exposed cloud keys are typically used within minutes of being pushed.

OWASP’s secrets management cheat sheet covers the storage, distribution and rotation practices in full.

Rotation is the control that turns a permanent compromise into a temporary one. It is also the control most often skipped, because nothing visibly breaks when you do not do it.