Secrets management

Play this lesson

Keys in the wrong place

A secret is anything that grants access: an API key, a database password, a signing key. Course 1 kept them out of code in a .env file. Shard Garden now has dozens of secrets on many servers.

A secrets manager

Google Cloud's Secret Manager "lets you store and manage sensitive data such as API keys". "A secret version stores the actual secret data", and IAM roles give "granular access" to each one.

Each server can read only the secrets its job needs.

Quick check

The race server needs the database password, but not the payment key. What should it be allowed to read?

  1. The database password only
  2. Every secret, just in case
  3. A copy of all secrets baked into its image
Show the answer

The database password only

If the race server is ever broken into, the attacker gets only what it could read. Least access means least damage.

Caught before the push

GitHub's secret scanning "automatically detects credential leaks". Its push protection goes earlier: it "blocks pushes that contain secrets before they reach your repository."

Leaked? Rotate.

To rotate a secret is to replace it with a new one and switch the old one off. GitHub's advice for a leak: "rotate the affected credential immediately".

Removing the secret from Git history is "time-intensive and often unnecessary if you've already revoked the credential."

First move

Ten minutes ago, Kai pushed the payment key to a public repo. What comes first?

  1. Revoke the key and replace it
  2. Delete the commit from history
  3. Make the repo private
Show the answer

Revoke the key and replace it

Copies may already exist. Only revoking the key makes every copy useless.

Rotate on a schedule

Secret Manager's docs: "Rotating your secrets protects against unauthorized access". A new version is added, servers switch to it, then the old one is disabled. Priya rotates Shard Garden's database password every 90 days.

Quick check

A secret baked into a container image is safe, because images never change.

Show the answer

False

Images are copied to registries and laptops. Anyone who has the image has the secret, and it can't be rotated without a new image.

Code from strangers

Most of the code in Shard Garden was written by people outside the studio.

Bolt says: Next: supply-chain security.

Fact-checked 12 October 2026