security-secrets-management

Secrets, Service Hardening, and Supply-Chain Trust

Use when standing up a self-hosted service, wiring API keys, or shipping code to the public — anywhere a leaked credential or unsigned artifact is a real cost.

1. Never commit secrets

• Keep secrets in an untracked .env (gitignored), read them at runtime via env vars, never in source.
• .gitignore must include .env, *.pem, *.key, keystores, and local config.
• If a secret was ever committed, assume it's compromised: rotate it, don't just delete it. History preserves it.

Skills like Skill Vault's security-secrets-management and its sibling deploy-secret-hygiene exist precisely because "remove the line" is a false fix.

2. Scan for leaks continuously

tool	finds	run
gitleaks	known secret patterns + entropy	pre-commit + CI
bandit	Python code security smells	bandit -r .
git history scan	secrets already committed	gitleaks detect --log-opts="--all"

Gate CI on a clean scan; the cost of a leak multiplies the moment it's public.

3. Least-privilege API keys

• Scope each key to the minimum capability it needs (read-only, one bucket, one API) and give it a short expiry.
• Name keys so you can identify and revoke them (sv-ci-deploy, not key1).
• Rotate on a schedule and on any suspicion.
• Prefer a signed/token identity over raw long-lived keys where your platform supports it — this mirrors Skill Vault's trust model below.

4. SSH key hygiene

• Use a passphrase-protected key or an agent; never a shared key in a repo.
• Add public keys to the target via ssh-copy-id, and restrict keys in authorized_keys with command=/no-port-forwarding where the key is purpose-built.
• Fingerprint-check on first connect; reject a changed host key.

5. Hardening a self-hosted service

• TLS: terminate HTTPS at the edge (nginx with Let's Encrypt); redirect all HTTP to HTTPS and set HSTS. A self-hosted app behind nginx should see only X-Forwarded-Proto: https and treat non-TLS requests as untrusted.
• Passwords: hash with a slow adaptive KDF — pbkdf2_hmac (many iterations) or argon2. Never store plaintext, single-round SHA, or MD5.

  import hashlib
  
  salt = secrets.token_bytes(16)
  digest = hashlib.pbkdf2_hmac("sha256", pw.encode(), salt, 600_000)
  

  Compare with hmac.compare_digest — not == — to avoid timing side channels.
• Sessions: use httpOnly cookies (Set-Cookie: ...; HttpOnly; Secure; SameSite=Lax) so JS can't read the token and it isn't sent over plain HTTP.