Secrets Management
Store and rotate credentials securely.
Install 安装
curl -sSL https://updating.cc/skills/devops/secrets-management/SKILL.md -o ~/.agents/skills/devops__secrets-management/SKILL.mdSKILL.md Preview 技能内容预览
---
name: Secrets Management
description: Store and rotate credentials securely.
---
# Secrets Management
A secret in code, in config, or in chat is a breach waiting to happen. Centralize secrets in a vault and inject them at runtime.
## Principles
- **One source of truth.** A secrets manager (Vault, cloud KMS, the platform's secret store). Not env files committed to git, not Slack DMs.
- **Inject at runtime.** The app reads secrets from the vault/env at startup, never from a checked-in file. The artifact is the same across environments; only the injected secrets differ.
- **Least privilege.** Each service accesses only the secrets it needs. A compromised service shouldn't unlock everything.
- **Rotation.** Secrets that never rotate are leaks-in-waiting. Automate rotation where possible; make it routine, not an event.
## Audit
- Every secret access is logged. Anomalous access patterns are how you catch compromise early.