secrets-management

Baseline

Applies when: Writing or committing .env/secret files, .gitignore or CI workflow configuration, container/Kubernetes/Terraform manifests defining runtime config, application code that reads credentials or logs errors, or incident-response steps after a secret is exposed.

Always:

• Add .env* patterns to .gitignore before the first .env file exists; commit only .env.example with key names, no values.
• Reference CI secrets from the provider's secret store (${{ secrets.X }} or masked variables), never as plain variables; never echo, printenv, env, or set -x a secret.
• Read secrets from the process environment or a vault-fetch SDK at runtime; never from a URL query/path segment or a file baked into the image.
• Use different secret values per environment; never copy a production secret into a lower environment or share one across environments.
• Keep Authorization headers, cookies, connection strings, and full environment dumps out of exception messages, logs, and observability payloads.
• On exposure, rotate the secret at the source and verify the new value is in use before any cleanup; revoke the old value before rewriting history or deleting logs.

Never:

• Commit a .env file, or consider it cleaned up once a later commit deletes it.
• Echo a secret, run printenv/env, or enable set -x in a CI workflow step.
• Log or return a connection string with embedded credentials, in an error message or a debug endpoint.
• Share the same secret value across development, staging, and production.
• "Remediate" an exposed secret by deleting the file or rewriting git history before revoking the credential at its source.

Open the full component before acting: it has the examples, the remediation steps, and the detection patterns.

Why

Secrets fail in predictable ways. secret-blocking catches the hardcoded patterns themselves — sk-live-..., AKIA..., private-key blocks — and prevents them from being written into source files. But secrets that are correctly handled at the point of generation still fail in five other places: