Lesson 4.2
Secrets management
Secrets belong in a manager, injected at runtime, never in the repository. Assume anything committed once is compromised forever.
18mIntermediate6,414 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
Secrets belong in a manager, injected at runtime, never in the repository. Assume anything committed once is compromised forever.
What this lesson covers
- Keep credentials out of source control
- Inject secrets at runtime and scope them tightly
- Rotate credentials and revoke exposed ones immediately
This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- Keep credentials out of source control
- Inject secrets at runtime and scope them tightly
- Rotate credentials and revoke exposed ones immediately
Pro Tip
A secret committed once is compromised even after you delete the commit. Rotate it, do not just remove it.