secrets-management
Secrets Management
A secret in source control is compromised the moment it is committed, regardless of whether the repo is public — history, forks, CI logs, and local clones all outlive the "private" label. The fix is not discipline, because discipline does not scale past one careless commit. The fix is making it structurally hard to commit a secret and structurally easy to fetch one at runtime from somewhere that isn't a text file.
Treat every credential as a liability with a lifecycle: issued, scoped, rotated, and revocable. A secret with no expiry and no owner is not a convenience, it is deferred incident.
A secret you cannot rotate in minutes is not a secret, it is a permanent liability.
For step-by-step zero-downtime rotation and a leaked-secret response checklist, read
references/rotation-playbook.md.