Secrets Management

Picture a workplace where passwords used to live on sticky notes stuck to monitors. Anyone walking by could read them, and when a password changed, someone had to remember to peel off the old note and write a new one. A secrets manager replaces every sticky note with a vault. Passwords, API keys, and other 'secrets' — sensitive values your app needs but people shouldn't casually see — live inside it instead of sitting in code or config files in plain view. The vault decides who's allowed to open it, and it hands out the current value only to those with permission. It also keeps a version history, so you can rotate a secret — replace it with a fresh one — without instantly breaking whatever was still using the old one.

1. 1Store each secret under a name, along with the list of roles allowed to read it. This is like storing something in the vault along with the list of people who know the combination.
2. 2When something asks for a secret, first check whether its role is on the allowed list. If there's no match, give no value: reject the request before you ever touch the vault contents.
3. 3If the role is allowed, hand back the current, latest version by default. Never print or log the raw secret in full. Mask it, showing just enough to confirm which secret it is.
4. 4To rotate a secret, store a new value under the same name as a new version. Keep the old version around, rather than deleting it right away, so anything still using the old value doesn't break immediately.

Use this any time your code needs a password, API key, certificate, or token to talk to something else. Secrets management keeps those values out of source code and config files, where they'd otherwise get stuck in history forever. It controls exactly who and what can read them, and it turns rotating a leaked or expiring secret into a routine task instead of a scramble.

• ⚠Hardcoding a secret directly in source code 'just for now.' 'For now' becomes forever the moment it's committed, since it stays in the project's history even after you remove it.
• ⚠Printing or logging a secret's full value anywhere, even for debugging. Logs get copied, forwarded, and stored longer than anyone expects.
• ⚠Deleting the old version the instant you rotate a secret. Anything still using the old value, such as a slow-restarting server or a cached config, breaks immediately instead of getting time to pick up the new one.