Section 29 · Code Quality & Architecture
Secrets Management
How secrets are stored, loaded, and protected across environments
This guide walks you through auditing a project's secrets management practices - how secrets are stored, loaded, and protected.
The Goal: Zero Leaked Secrets
Secrets should be impossible to leak through code, impossible to access without authorization, and impossible to share across environments.
- Managed secrets — production credentials in a dedicated secret manager with rotation and audit trails
- Environment injection — secrets loaded via environment variables at startup, never read from files at runtime
- No git exposure — nothing committed to version control, with scanning to prevent future leaks
- Isolated environments — dev, staging, and prod use completely separate credentials
- Least privilege — access follows principle of minimal permissions with proper service accounts and controls
Before You Start
- Identify deployment target (GCP, AWS, Azure, self-hosted, etc.)
- Identify secret manager in use (GCP Secret Manager, AWS Secrets Manager, Vault, Doppler, etc.)
- Understand deployment method (Kubernetes, Docker, serverless, VMs, etc.)
- Check for existing secret scanning tools (gitleaks, trufflehog, GitHub secret scanning)
Secret Storage
Production secrets managed by dedicated secret manager with rotation and audit capabilities
“Where are your production secrets stored right now?”
Secrets injected into process environment at startup, not read from files at runtime
“Would a crash dump expose any credentials?”
Secrets exist only in memory after environment injection - no files on production servers
“Any .env files sitting on a production server right now?”
Secret Security
Secret scanning in place to prevent commits and detect past leaks
“Has anyone actually scanned your full git history for leaks?”
Each environment has completely separate credentials - compromising one doesn't expose others
“Would a staging breach give access to production data?”
Secret access follows least privilege - dedicated service accounts, limited human access, audit trails
“How many people on your team can read production database passwords?”