Secret Management
"How we store secrets, who can see them, and how we handle leaks."
Why this exists
A committed API key is public. GitHub scans for secrets but misses some. Even a 30-second delay between a bad commit and revocation can lead to a breach. We manage secrets deliberately, not by convention.
Operational Flow
Storage: Store all secrets in Doppler for projects, and 1Password for personal credentials.
No plaintext: Never write secrets in code, comments, Slack, Notion, or video recordings.
Environment hygiene: Confirm local `.env` files are in `.gitignore` before your first commit. Never include real values in `.env.example` files.
Rotation: Rotate keys and tokens quarterly, or immediately when a developer leaves the project.
Leak response: Revoke the leaked secret within minutes. Report the incident, rotate the key, and write a postmortem.
Access scoping: Limit production secrets in Doppler. Developers get dev environment access by default; prod access requires approval.
Audit: Review Doppler and 1Password access logs monthly and during incidents.
What good looks like
- A developer adds an integration, adds the secret to Doppler, and commits only the key name.
- Quarterly rotation takes under an hour because the runbook is clear and tested.
- A committed secret is revoked and force-pushed within three minutes, and logged for postmortem.
What NOT to do
- Don't save secrets in Notion, Linear, or GitHub issues.
- Don't wait to check the scope before revoking a key. Revoke first, investigate second.
- Don't trust `.env` files in private repositories. Private repos get shared or cloned onto unsecured machines.
A 2022 analysis found over 100,000 exposed credentials in public GitHub repositories. Most came from the same mistakes: committing a .env file during setup, hardcoding a token for debugging and forgetting it, or pasting a key into a README. These are not complex hacks. They are simple lapses in attention during a project’s first hour. We avoid this by gitignoring all environment files by default and scanning code before pushing.
Secrets go in Doppler or 1Password. If you don’t know how to inject a key, ask before guessing. Spending ten minutes doing it right is better than explaining to a client why their databases were crawled because a credential leaked.