What is Secrets Management?

Secrets management covers secure creation, storage, delivery, use, rotation and revocation of machine credentials. Examples are API keys, database passwords, private keys, tokens, certificates and signing keys. A secret in a private repository or image is not safe: copies reach history, CI logs, caches, backups and developer devices.

Unsafe and better example

// Unsafe: secret is part of source and artifact
const client = new ApiClient({
  token: 'prod_live_abc123...'
});

// Better: short-lived workload identity
const token = await workloadIdentity.getAccessToken({
  audience: 'payments-api',
  ttl: '10m'
});
const client = new ApiClient({ token });

An environment variable is better than hardcoded source but is not complete secrets management. It may appear in dumps or diagnostics. Prefer workload identities that issue short-lived credentials without a static secret.

Secret lifecycle

1. Create:
   Random, purpose-bound and least privileged.
2. Store:
   Encrypted in a central store or hardware module.
3. Deliver:
   At runtime to authenticated workloads with minimal copies.
4. Monitor:
   Log access and anomalies, never the value itself.
5. Rotate/revoke:
   Regularly and immediately on suspicion, with safe key overlap.

Responding to exposure

Revoke or rotate first; deleting a commit is insufficient. Then review usage and logs, identify dependent systems and investigate persistence. Clean history only afterward. The old value remains compromised even if exposure was brief or the repository private.

Useful open-source tools

Gitleaks and TruffleHog search files and Git history; TruffleHog can verify many secret types. detect-secrets supports pre-commit baselines. Scanners produce false positives and need custom patterns; combine commit, CI and periodic scanning with a managed store.