Secrets management

A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Move credentials and API keys out of the code and its history into environment variables or a secrets manager, with a checked-in .env.example and a scanner that keeps them out for good.

Usually comes after: First deploy.

Leads to: Accounts & spending guardrails, TLS & network policy, Input validation.

Prompt for your AI assistant

Audit the codebase and its git history for hardcoded secrets, move them to environment variables, add a .env.example with placeholder values and ensure .env is gitignored. Rotate any secret that was ever committed. Add a secret scanner to CI and to a pre-commit hook. If this project ships code to the browser, everything in it is public: keep only ids that are public by design in its environment files and add a CI check that searches the built output for secret patterns.

• Show on map
• This step as Markdown
• Every step of the tree, for AI assistants

This is https://gradus.kazet.blog/tree/cloud-application/step/secrets-management as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.