API keys, database passwords, signing keys and tokens end up in repositories, build logs, chat messages and container images far more often than anyone intends. Use this checklist to close the common gaps.
The checklist
- Never commit secrets. Add secret scanning to pre-commit hooks and your CI pipeline. Treat any secret that reaches a repository as compromised: rotate it, because deleting it from the latest commit leaves it in the history.
- Use a secrets manager. Applications fetch secrets at runtime from a central store. Do not bake them into images, and do not keep
.envfiles in source control. - Prefer short-lived credentials. Use workload identity or OIDC federation for CI/CD and cloud access instead of long-lived keys that sit in a settings page.
- Apply least privilege. Give each service its own identity with only the access it needs. Keep development, test and production secrets separate, and keep production secrets off developer laptops.
- Rotate on a schedule and on events. Rotate regularly, and immediately when someone leaves or a system is retired. Automate it, because manual rotation gets skipped.
- Keep secrets out of logs and tickets. Redact tokens in logs, error messages, URLs and support tickets.
- Audit and alert. Record who or what reads each secret, and alert on unusual access.
- Rehearse the leak. Have a short runbook: revoke, rotate, check usage logs for misuse, clean up, and write a blameless post-mortem.
Start small. If you can only do two things this week, turn on secret scanning and move your three most powerful credentials into a secrets manager.
Most of these steps are cheap, and together they remove a large share of the avoidable risk in a typical delivery pipeline.