Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Secret management is the handling of credentials — API keys, database passwords, signing keys — so that they are available where needed and nowhere else. The baseline rule is that a secret must never enter version control, because history is permanent and a committed secret is compromised even after it is removed.
The usual mechanisms are environment variables injected at run time, a password manager or vault for human access, and a platform's secret store for automation. Each has a distribution problem: getting the secret to every place that needs it, including the ones nobody remembers — a test configuration, a container image, a code-generation step, a newly provisioned working copy.
Three practical notes.
A missing secret should fail loudly. An empty credential defaulted to an empty string produces an authentication error far from the cause. See Fail Fast.
Automation environments scope secrets differently. A workflow triggered by an automated actor may receive a restricted set, so a secret that is present in one trigger context reads as empty in another — with no error anywhere.
Rotation must be possible. A secret nobody can rotate without downtime will not be rotated, which turns a routine hygiene task into an incident.
See also7
Least Privilege
Granting only the permissions actually required, so a compromise has a small ceiling.
Systems & Tooling17 connections
Environment Variable
A named value in a process's environment, inherited by its children — the standard configuration channel.
Systems & Tooling15 connections
Supply Chain Security
Protecting against compromise arriving through the code and tooling a project depends on.
Version Control & Delivery13 connections
Silent Failure
A failure that produces no signal, so the absence of an error reads as success.
Method63 connections
Defensive Default
A substituted value that papers over a missing input and hides the misconfiguration that produced it.
Method12 connections
Prompt Injection
Untrusted content that reaches a model's context and is treated as instruction.
Agents & Language Models13 connections
Continuous Deployment
Automatically releasing every change that passes validation.
Version Control & Delivery15 connections
Related2
Nearby in the graph rather than deliberately chosen. Looser, sometimes surprising.
Linked from20
- Caller ID AuthenticationNetworks & Distribution
Cryptographic attestation of an originating telephone number, and why spoofed calls survive it.
- Code SigningSystems & Tooling
Cryptographically attesting who produced a binary, and the operating-system checks built on it.
- ContainerizationSystems & Tooling
Packaging an application with its dependencies into an isolated, reproducible runtime unit.
- Continuous DeploymentVersion Control & Delivery
Automatically releasing every change that passes validation.
- CronSystems & Tooling
Time-based scheduling of recurring jobs, and the reasons scheduled jobs quietly stop working.
- Defensive DefaultMethod
A substituted value that papers over a missing input and hides the misconfiguration that produced it.
- Domain Name SystemSystems & Tooling
The distributed directory translating names to addresses, and the layer where propagation delays live.
- DotfilesSystems & Tooling
A tracked repository of personal configuration, making a machine setup reproducible.
- Environment VariableSystems & Tooling
A named value in a process's environment, inherited by its children — the standard configuration channel.
- eSIMNetworks & Distribution
A SIM soldered into the device and provisioned over the air, with profiles downloaded rather than cards swapped.
- Fail FastMethod
Crash at the point of misconfiguration rather than degrading quietly into a wrong state.
- Least PrivilegeSystems & Tooling
Granting only the permissions actually required, so a compromise has a small ceiling.
- Package ManagerSystems & Tooling
The tool that resolves, fetches, and installs dependencies, and pins them for reproducibility.
- Prompt InjectionAgents & Language Models
Untrusted content that reaches a model's context and is treated as instruction.
- Same-Origin PolicyWeb Platform
The browser rule isolating documents by scheme, host, and port, and the mechanisms for relaxing it.
- Semantic VersioningVersion Control & Delivery
A version-numbering convention where the number communicates the kind of change.
- Supply Chain SecurityVersion Control & Delivery
Protecting against compromise arriving through the code and tooling a project depends on.
- Symbolic LinkSystems & Tooling
A file that points at another path, resolved transparently by most operations.
- Virtual Private NetworkNetworks & Distribution
An encrypted tunnel that presents a remote network as local, and the narrow set of things a commercial one actually hides.
- XDG Base Directory SpecificationSystems & Tooling
A convention placing configuration, data, cache, and state in defined directories rather than the home directory.