Never in code
Not in git. Not in Dockerfiles. Not in env vars committed to config repos.
Advertisement
Secret manager
Vault, AWS Secrets Manager, Google Secret Manager. Fetch at startup + refresh periodically.
Advertisement
Never log secrets
Redact in log formatters. Include a canary secret in test envs to alert if it leaks.