Secrets management

Secrets belong in a manager, injected at runtime, never in the repository. Assume anything committed once is compromised forever.

19m
Intermediate

Video by KodeKloud · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

Keep credentials out of source control
Inject secrets at runtime and scope them tightly
Rotate credentials and revoke exposed ones immediately

This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

Keep credentials out of source control
Inject secrets at runtime and scope them tightly
Rotate credentials and revoke exposed ones immediately

Resources

OWASP Top 10The official reference for the tools used in this lesson.