Credentials and keys.
WHAT COUNTS
Passwords API keys Certificates and private keys Database credentials Encryption keys
WHERE THEY MUST NOT BE
Version control Code Log output Error messages Shared documents
WHERE THEY SHOULD BE
Environment configuration on each server A secrets manager, for larger setups A password manager, for human access
WHAT TO COMMIT INSTEAD
An example file listing what is required, with placeholder values.
WHY
So anyone setting up knows what is needed.
WHAT TO ROTATE
Anything that may have been exposed Anything held by someone who left Keys used by automation, periodically
WHAT TO GIVE AUTOMATION
Its own credentials, limited to what it does.
Never a person's.
WHAT TO SCAN FOR
Secrets in your repository, using an automated check.
WHY
They are committed accidentally more often than anyone expects.
WHAT TO DO ON DISCOVERY
Rotate immediately.
