Security & Compliance
Secrets Management
Securely storing and controlling access to credentials like API keys, database passwords, and tokens, instead of hardcoding them.
Secrets management is how you handle the credentials your application needs, database passwords, API keys, tokens, without scattering them through your code and config where they leak. The wrong way is hardcoding a key in a source file that ends up in git history forever. The right way stores secrets in a dedicated system that encrypts them and hands them to the app at runtime.
The tooling ranges from simple to serious. Environment variables injected by your host, Vercel, Railway, and Render all do this, cover the basics for most apps. Dedicated secret stores like HashiCorp Vault or the cloud providers' secret managers add rotation, fine-grained access, and audit logs for higher-stakes environments. The common thread is keeping secrets out of code and out of anything checked into version control.
The failure mode is depressingly common: a secret committed to a public repository, found by an automated scanner within minutes, and used to run up charges or steal data. Treat every credential as something that must never touch your codebase, and rotate anything that slips.
Go deeper
- Cloud Hosting Security: What's Your Job vs the Provider'sThe shared responsibility model, and the specific things people forget to configure.