LESSON 4.2
Secrets management
Learn key techniques and workflows in Practical Web Security.
18m
intermediate
6,414 students
Overview
Secrets belong in a manager, injected at runtime, never in the repository. Assume anything committed once is compromised forever.
In this lesson you will:
- Keep credentials out of source control
- Inject secrets at runtime and scope them tightly
- Rotate credentials and revoke exposed ones immediately
Pro Tip
A secret committed once is compromised even after you delete the commit. Rotate it, do not just remove it.