Secrets Management

Passwords, API keys, tokens and certificates are "secrets". Leaked secrets cause many breaches. This roadmap shows how to store, issue, rotate and monitor them properly. You need basic development or operations experience.

• Know where your projects store secrets today
• Have a lab with Docker
• Plan your study time

• CyberA4U Academy — courses

Secrets end up in code, config files, CI variables, chat and wikis. Sprawl makes them impossible to rotate and easy to leak.

• Recognize where secrets typically leak
• Inventory existing secrets
• Understand the risks of long-lived secrets

Tools & tech: Secrets

• OWASP Secrets Management Cheat Sheet

Secret managers such as HashiCorp Vault or cloud secret services centralize storage, access control, auditing and rotation.

• Explain secret manager components
• Compare self-hosted and cloud options
• Plan high availability and unsealing

Tools & tech: Secrets

• HashiCorp Vault — Architecture

Credentials that expire in minutes or hours — dynamic database users, cloud temporary credentials — limit damage when leaked.

• Prefer temporary credentials over static keys
• Issue dynamic database credentials
• Understand token lifetimes

Tools & tech: Secrets

• AWS IAM — Temporary security credentials
• Vault — Database secrets engine (dynamic credentials)

Rotation replaces secrets regularly and after any suspected leak. Automated rotation makes it routine instead of risky.

• Automate rotation for common secret types
• Rotate without downtime
• Rotate immediately after exposure

Tools & tech: Secrets

• AWS Secrets Manager — Rotate secrets

If using the secret manager is harder than pasting a key into code, developers will paste the key. Good tooling and defaults make the secure way the easy way.

• Provide simple local-development workflows
• Inject secrets automatically at runtime
• Document patterns with examples

Tools & tech: Secrets

• OWASP Secrets Management Cheat Sheet

CI/CD systems need secrets to deploy, which makes them attractive targets. Scope, protect and minimize them.

• Store CI secrets in the platform's secret store
• Use OIDC federation instead of static cloud keys
• Limit secrets to protected branches

Tools & tech: Secrets

• GitHub Actions — Using secrets

Kubernetes Secrets and cloud secret services integrate with workloads, but need encryption and tight access control.

• Use Kubernetes Secrets safely
• Integrate external secret stores
• Restrict which workloads can read which secrets

Tools & tech: Secrets

• Kubernetes — Secrets

Secret scanning in repositories, CI logs and public code catches leaks early so they can be rotated.

• Enable push protection and scanning
• Scan history, not only new commits
• Respond to alerts quickly

Tools & tech: Secrets

• GitHub — About secret scanning
• Gitleaks (GitHub)

When a secret leaks: revoke or rotate it first, then investigate how it was used, then remove it from history and fix the cause.

• Revoke and rotate immediately
• Check logs for misuse
• Remove the leak and prevent recurrence

Tools & tech: Secrets

• GitHub — About secret scanning

Every secret needs an owner, a purpose, a maximum lifetime and a rotation plan. A short policy makes this consistent.

• Define ownership and lifetimes
• Set rules for storage and sharing
• Review compliance regularly

Tools & tech: Secrets

• OWASP Secrets Management Cheat Sheet

Audit logs show who read which secret and when, which is essential for investigating leaks.

• Enable audit logging in the secret manager
• Alert on unusual access
• Review access regularly

Tools & tech: Secrets

• Vault — Audit devices

Bring it together: one central secret manager, workload identities, short-lived credentials, automated rotation, scanning and auditing.

• Design an end-to-end secrets architecture
• Plan migration from hard-coded secrets
• Measure progress

Tools & tech: Secrets

• OWASP Secrets Management Cheat Sheet

Check that you can remove secrets from code, issue short-lived credentials, rotate secrets and respond to leaks.

• Store and inject secrets securely
• Automate rotation and scanning
• Respond to a leak

• CyberA4U CTF Arena — practice challenges

You can now manage secrets properly. Continue with DevSecOps Pipeline, Kubernetes Security or IAM Security.

• Keep your lab Vault
• Choose your next roadmap
• Share your reference design

• CyberA4U CTF Arena — practice challenges