Secrets in git are a security incident. 12-factor: config in environment; in prod — vault or DB settings with audit.
Dev vs prod
- Dev: .env.local gitignored
- Prod: admin DB or Vault
- Never commit .env.prod
Rotation
JWT, API keys, DB passwords on calendar. Dual-key period when switching payment providers.
Least privilege
- CI deploy key — deploy only
- App DB user without SUPERUSER
- Separate keys per integration
Checklist
- gitleaks in CI
- Secrets inventory
- Leak incident plan
Quick secrets audit
- gitleaks or git-secrets in CI
- Inventory: storage, owner, rotation date
- No prod secrets in Slack or committed .env
- On leak: rotate → revoke → post-mortem