Secrets Management
Storing API keys, credentials, and certificates in a dedicated vault, outside source code, with rotation and audited access.
Secrets management is the discipline of keeping credentials out of source code, config files, and logs — instead fetching them at runtime from a dedicated secrets store that supports rotation, fine-grained access control, and an audit trail of who accessed what, when. A secret committed to a git repository is effectively compromised the moment it’s pushed, which is precisely the failure this discipline exists to prevent.
Worked example: store credentials (API keys, DB passwords, certs) in a dedicated system (Vault, AWS Secrets Manager, KMS) that encrypts them at rest, injects them at runtime, rotates them, and audits access — instead of hardcoding them in code or committed env files. Gotcha: a secret in git history stays there after you delete it (rotate it, do not just remove the line); and the bootstrap problem is real — the app needs SOME credential to fetch the others, so that root identity (an IAM role, a machine identity) is the crown jewel.