A secret is any value that grants access: an API key, database password, signing key or token. The goal is not to hide secrets forever; it is to limit their blast radius and make rotation routine.
Why environment variables are not enough
Environment variables are convenient and leak easily:
- printed in crash reports and debug logs;
- visible in process listings to privileged users;
- copied into container images;
- exposed by misconfigured CI runners.
A dedicated secret manager adds access control, audit and rotation.
Rotation
A rotation plan answers:
- Who can create a new version?
- How does the application pick it up without downtime?
- How long do old versions remain valid?
- Who verifies the old credential is revoked?
- What happens if rotation fails?
Design for two valid versions during a transition, then retire the old one.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.