This lesson's interactive features are locked, please to keep using them
Managing Secrets
A secret is any value that grants access, signs data, or proves identity. If an attacker steals one, they don't need to break in... they can just use the credential. Common secrets include:
- API keys
- Database credentials
- OAuth client secrets
- Session and JSON Web Token signing keys
- Webhook signing secrets
Configuration isn't automatically secret. A port number, feature flag, or public service URL can live in configuration without needing protection. The real question is what the value lets someone do.
Imagine an app that commits its adminAPIAccess key directly in source code. You might think, "Well, the repo is private, so no one can see it," but now the key spreads through Git history, CI logs, backups, and developer machines. Deleting the line in a later commit doesn't erase those copies! The only safe option is to rotate the key.
If a real secret is ever committed to a repository, treat it as compromised. Revoke or rotate it first, then remove it from the code and investigate where else it spread.