Ask HN: Do you read Secrets from Environment Variables

Re:Ask HN: Do you read Secrets from Environment Variables by AlwaysNewb23 on Tuesday February 06, 2024 @11:44AM (#39276605)

Are you familiar with the recent Mercedes-Benz Source Code Exposure [1]? It's a good example of why you should consider a secrets manager for any serious project. Environment variables come with a lot of risks and are difficult to manage as teams grow. 1) ENV files are easy to accidentally push to a repo. 2) It's easy for environment variables to get out of sync among developers. 3) In the case of exposure, it's often difficult to rotate secrets quickly. A secrets manager removes this risk - but you do need to trust whatever service you decide to use, as well as make sure it's compatible with your infrastructure/cloud environment.

[1] https://www.doppler.com/blog/lessons-from-mercedes-benz-sour...)

[ Parent | on HN ]

Re:Ask HN: Do you read Secrets from Environment Variables by AlwaysNewb23 on Tuesday February 06, 2024 @11:46AM (#39276645)

For personal projects, it's probably fine to just use environmental variables and .env files the traditional way. The security risk really increases when you start to scale and work with other team members.

[ Parent | on HN ]

Re:Ask HN: Do you read Secrets from Environment Variables by tester457 on Tuesday February 06, 2024 @12:39PM (#39277591)

Thank you for your answers, they were very helpful.

When the Mercedes-Benz Source Code Exposure happened I remembered I wasn't doing secrets management in the proper way, but good to know there's less risk since I'm a solo developer. But Doppler looks worth a shot.

[ Parent | on HN ]