Stop hardcoding, start rotating: a practical take on secrets management

Every engineer has seen it, and most have done it: an API key pasted directly into a config file “just to test something,” then quietly shipped. Secrets don’t leak because people are careless — they leak because the convenient place to put a secret is almost always the wrong place. Fix the convenience problem and most leaks disappear.

The first principle is that secrets should never live in source control. Not encrypted, not in a .env you promised yourself you’d gitignore — just not there. The moment a credential enters git history, it’s effectively public, because history is forever and clones are everywhere. Scanning tools that block secrets at commit time are worth more than any amount of cleanup afterward.

Once secrets are out of the code, the question becomes how services get them at runtime. The answer is injection, not embedding: the application asks for a secret when it starts, receives it from a dedicated store, and never persists it to disk.

1
import { getSecret } from './vault-client.js'
2

3
async function initDatabase() {
4
  // Fetched at runtime, scoped to this service, expires in minutes
5
  const dbUrl = await getSecret('db/connection-string')
6
  return connect(dbUrl)
7
}

Assume every secret will leak eventually. Design so that when one does, it’s a shrug, not a fire drill.

That assumption is the real shift. Static credentials make a leak permanent — you don’t know when it happened, and rotating means a painful, coordinated scramble. Short-lived, automatically rotated credentials flip that: a leaked token is already expiring, and rotation is a routine event the system does on its own rather than a project someone has to schedule.

Rotation only works if it’s cheap. If rotating a database password means a maintenance window and three teams on a call, it won’t happen until after a breach forces it. Build rotation into the platform — automatic issuance, automatic renewal, automatic revocation — so that changing a secret is as unremarkable as restarting a pod.

Good secrets management is invisible when it works. No one thinks about the keys, because the keys take care of themselves — and the day one leaks, the honest answer is “it already rotated.”

Written by Gaurav Raj (@thehackersbrain) ↗