hmmmm ok well. our small team has API keys and database passwords scattered around: some in CI variables, some in .env files on servers, and (Im embarrassed to say) a couple committed to a private repo at some point. We want to clean this up.
What approaches have worked for small teams?? We dont have a dedicated seucrity person or budget for an enterprise secrets platform. thx in advance!!
hmmm first, deal with the committed ones: rotate them. removing a secret from git history is not enough, cuz it may already have been cloned or cached. change the credential, then clean the history if you want, and add a secret scanning hook or CI check so it doenst happen again. fingers crossed 🤞
A few observations... id be hesitant about encrypted secrets in the repo for a small team without much security experience. key management becomes the new problem, and its easy to end up with the decryption key sitting next to the repo. A managed secrets service with access logs is simpler to reason about.
Before anything else: encrypted secrets in the repo (with a tool that encrypts values using keys from a KMS or age/GPG) works well for config-as-code setpus. Secrets are versioned with teh code and reviewed in PRs, but only decrypted at deploy time 🤷 Just make sure key access is limited and documented.
logs will tell you more than guesses. lmk how it goes
Sign in or create an account to reply.
