安全的机密管理

You have protected data at rest and in transit and learned key management. But the secrets your app itself uses — DB passwords, API keys, signing keys — are a prime target. Mishandling them undoes everything else.

Embedding a secret in source code means it lives forever in version history, is visible to everyone with repo access, and ships in every build.

Once a secret is committed, deleting it later is not enough — it stays in history. Treat any leaked secret as compromised and rotate it immediately. Use a .gitignore and pre-commit scanning to prevent leaks.

A first step is injecting secrets via environment variables at runtime, keeping them out of code. Config stays in the environment, not the artifact.

Env vars are better than hardcoding but still leak via crash dumps, child processes, and logging. They also lack rotation and audit. For real systems, use a dedicated secret manager.

Tools like Vault, AWS Secrets Manager, and GCP Secret Manager store secrets encrypted and serve them to authorized services on demand, with access control and an audit log.

Each service should read only the secrets it needs. Scope access by identity so a compromised service cannot dump every credential in the vault.

Rotate secrets regularly and immediately after any suspected leak. Secret managers can automate rotation, issuing new credentials and revoking old ones without downtime.

The strongest pattern: generate short-lived credentials on demand that expire in minutes. A leaked secret is useless almost immediately, shrinking the attack window dramatically.

Scrub secrets from logs, error messages, and traces. Redact known secret keys before output, and audit logs periodically to confirm nothing sensitive leaks through.

Secret managers store values encrypted using a master key, often backed by a hardware security module or a cloud KMS. This means a stolen backup or disk image yields only ciphertext, tying secret protection back to solid key management.

You learned to manage secrets safely:

• Never hardcode or commit secrets
• Inject via environment, but prefer a secret manager
• Apply least privilege and an audit log
• Rotate regularly; favor short-lived credentials
• Never log secrets