API Keys & Secrets Management

Secret sprawl is the uncontrolled distribution and leakage of static credentials—API keys, database passwords, private encryption keys, and webhook secrets—across code repositories, unencrypted .env files, Docker images, and CI/CD logs.

The Attack Vector:

Automated botnets continuously scrape public and private Git commits in real time. Research indicates that when an AWS access key or Stripe secret is committed to a public GitHub repository, botnets detect and exploit the credential in under 60 seconds, provisioning thousands of dollars in cryptocurrency mining instances or draining balances.

Core Rules of Secrets Hygiene:

1. Never commit secrets to version control: Add .env, *.pem, *.key, and config credentials to .gitignore.
2. Pre-commit and CI/CD Scanning: Enforce automated scanning tools (e.g., TruffleHog, GitGuardian, GitHub Secret Scanning) in pre-commit git hooks and CI pull request gates.
3. Environment Variable Injection at Runtime: Inject secrets into runtime containers via orchestration mechanisms (Kubernetes Secrets, AWS Secrets Manager, HashiCorp Vault Agent) rather than baking them into immutable container images.