Foundations / 4 MIN READ

Keep secrets out of source

Secrets need deliberate storage, access, rotation, and revocation. Removing a leaked credential from a file does not make the credential safe again.

1. Give secrets a home

   Inject secrets at runtime from an appropriate secret store. Keep access scoped to the service and environment that need it.

2. Catch accidental exposure

   Scan commits and build output for accidental exposure. Avoid logging tokens, passwords, or sensitive configuration.

3. Revoke first, then investigate

   If a secret leaks, revoke or rotate it promptly, investigate its use, and address remaining copies in history and artifacts.