What Is Secrets Management?
Secrets management is how you store, distribute, rotate, and audit access to the credentials that unlock everything else — passwords, API keys, tokens, and encryption keys. It is key management made operational, and its central lesson is simple: secrets scattered through code and config are secrets waiting to leak. Centralizing and controlling them is one of the highest-value hygiene wins available.
Why not just put secrets in code or config?#
Because those places are the opposite of secret:
| Bad location | Why it leaks |
|---|---|
| Source code | Copied, shared, and preserved in history forever |
| Config files / images | Distributed with the app, often readable |
| Environment variables | Exposed in logs, process listings, errors |
| Wikis / tickets | Long-lived, widely accessible |
The classic disaster is an API key committed to a repository: even deleted, it lives in the git history, and a single leaked repo can hand an attacker the keys to your infrastructure.
What does good secrets management provide?#
A dedicated secrets manager or vault gives you:
- Central, encrypted storage with strict access control.
- Dynamic, short-lived secrets where possible, so a leak expires fast.
- Rotation so credentials change regularly.
- Audit logs of who accessed what.
Secrets management operationalizes key management for the whole stack. More at the Defense & Hardening hub.
Frequently asked questions#
What is secrets management?
Secrets management is the practice of securely storing, distributing, rotating, and auditing access to sensitive credentials — passwords, API keys, tokens, certificates, and encryption keys. Instead of scattering secrets in code, config files, and environment variables, a secrets manager centralizes them with access control, encryption, and an audit trail.
Why are secrets in source code so dangerous?
Because source code is copied, shared, backed up, and often ends up in repositories many people can read — and version history preserves secrets even after they are deleted. A single leaked repository can expose credentials to an entire infrastructure. Any secret that has touched source control should be considered compromised and rotated.