Handling keys and secrets.
WHAT TO NEVER DO
Commit credentials to version control Embed them in client-side code Send them in a query string Share one credential across environments
WHY CLIENT-SIDE EMBEDDING IS FATAL
Anything in a browser or mobile application is readable.
WHAT TO DO INSTEAD FOR CLIENT APPLICATIONS
Call your own server, which holds the credential.
WHERE TO STORE CREDENTIALS
Environment configuration, or a secrets manager.
WHAT A SECRETS MANAGER PROVIDES
Central storage, access control, rotation and audit.
WHAT TO USE PER ENVIRONMENT
Separate credentials.
WHY
A leak from development then cannot reach production.
WHAT TO SCOPE
Each credential to the minimum it needs.
WHAT TO DO ON ROTATION
Support two valid credentials briefly, so the change is not an outage.
WHAT TO DO WHEN A CREDENTIAL LEAKS
Revoke it immediately, then investigate.
WHY IN THAT ORDER
Every minute it remains valid is exposure.
WHAT TO CHECK AFTER ANY LEAK
What was accessed with it.
WHAT TO SCAN FOR
Credentials accidentally committed, using automated tooling.
WHY
It happens constantly, and history is permanent.
WHAT TO DO ABOUT ONE ALREADY COMMITTED
Rotate it, since removing the commit does not help.
WHAT TO DOCUMENT
Which credentials exist, what they access, and who holds them.
