What is Secrets management?

Handling API keys, passwords, and tokens so they're stored encrypted, never committed to code, and rotatable when leaked.

How it works

The most common leak is a secret hardcoded in a repo or a .env file that gets shared. Keep secrets out of source, store them in a protected file or a secrets manager, and rotate anything that might have been exposed.

Example

In practiceYou keep API keys in a 600-permission file outside the repo and load them as environment variables, never in the code itself.

Where should secrets live?

In environment variables or a dedicated secrets store, never in source control. Restrict file permissions and rotate on any suspected exposure.

Go deeper: Build a Hardened Linux Workstation

The complete, step-by-step guide — every command, config, and the reasoning behind it.

Get the guide