Secrets Management

Secrets are the keys to everything: passwords, API keys, certificates, tokens. Secrets management is the discipline of storing, delivering and rotating them so that no human sees more than they must and no repository leaks more than it should — because the most common root cause of the biggest breaches is a key that was somewhere it shouldn't have been.

What It Is

Secrets management is the controlled handling of credentials systems use to authenticate to each other: storage in purpose-built vaults (encrypted, access-controlled, audited) rather than in code, configuration files or spreadsheets; delivery to applications at runtime through verified identity rather than copied around; rotation on schedule and immediately on suspicion; and revocation when people or systems depart. The supporting hygiene: scanning repositories for accidentally committed secrets (which happens constantly, and once in git history, lives forever), separating environments so a test credential cannot touch production, and least-privilege scope so each secret opens only what its holder needs.

Why It Matters to You

This is the least glamorous and most breached boundary in practice: leaked credentials in source repositories, keys embedded in shipped code, shared admin passwords known to departed contractors — the mundane mechanisms behind a remarkable share of major incidents, including the exposure of cloud environments wholesale. The executive tests are simple: ask where secrets live (a named vault is the right shape; 'in the code' or 'with the team lead' are findings), ask about rotation, and ask whether anyone can list every credential the organisation has. That last question usually reveals that no one can — which is the beginning of the security conversation that matters.

When You'll Meet It

In security reviews, audits, and incident postmortems. When assessing any vendor or codebase, the repository-scan question — 'have secrets ever been committed?' — has an uncomfortable habit of being answered yes.