# Secrets management

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/secrets-management

Move credentials and API keys out of the code and its history into environment variables or a secrets manager, with a checked-in .env.example and a scanner that keeps them out for good.

Usually comes after: [First deploy](https://gradus.kazet.blog/tree/cloud-application/step/first-deploy).

Leads to: [Accounts & spending guardrails](https://gradus.kazet.blog/tree/cloud-application/step/account-guardrails), [TLS & network policy](https://gradus.kazet.blog/tree/cloud-application/step/tls-and-network-policy), [Input validation](https://gradus.kazet.blog/tree/cloud-application/step/input-validation).

## Prompt for your AI assistant

```
Audit the codebase and its git history for hardcoded secrets, move them to environment variables, add a .env.example with placeholder values and ensure .env is gitignored. Rotate any secret that was ever committed. Add a secret scanner to CI and to a pre-commit hook. If this project ships code to the browser, everything in it is public: keep only ids that are public by design in its environment files and add a CI check that searches the built output for secret patterns.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt