Secret management

Secret management is how an application receives the credentials it needs — database passwords, API keys, signing keys — without those values being written into the code.

The failure it prevents is the most common serious breach in small projects: a key committed to a repository. Once committed it is in the history permanently, and automated scanners find published keys within minutes, which is why the fix is always rotation rather than deletion.

The workable minimum is environment variables supplied at run time from a file that is never committed and is readable only by the service account. Beyond that, a managed secret store adds rotation, an audit trail and per-service access — worth it as soon as more than one person is deploying.