News for hackers. Stuff that matters.

A comment on Best practices for managing and storing secrets like API keys and credentials. Parent comment

Re:Best practices for managing and storing secrets like API ... by pmontra on Saturday June 13, 2020 @01:34AM (#23507074)
Rule #1 is really important. Unfortunately many small companies and most startups only have developers and no separate operations department. The best those developers can do is keeping secrets out of git, slack and email. I'm using git secret for a project of a customer with one internal developer and about five external consultants.
[ Parent | on HN ]
Re:Best practices for managing and storing secrets like API ... by somurzakov on Saturday June 13, 2020 @03:41PM (#23512091)
if that's the case, then only a team lead / most senior dev should have prod secrets. and I would prefer to be very low tech in terms of secrets management.

definitely not passing secrets in ENV (cause any process can access ENV and exfiltrate) or as command line argument (cause they will be logged as all tty commands are)

[ Parent | on HN ]