Secret Hygiene Checklist

How It Works

Teams struggle to balance secure secrets handling with convenient local development.

This recipe standardizes where secrets live, how they're injected, and how leaks are prevented.

Triggers

• Secrets appear in .env files, repos, logs, or tickets
• Developers paste secrets into tools or share them in chat
• Local dev requires painful manual secret entry

Steps

1. Define secret classes:

• local dummy,
• shared dev,
• staging,
• production.

1. Provide safe local defaults:

• .env.example without secrets,
• dummy creds for local containers where possible.

1. Use a secret manager for real environments; inject via runtime identity/permissions.
2. Add pre-commit scanning and CI secret scanning.
3. Create an incident process for rotation when leaks occur.

Expected Outcome

• Fewer leaks and faster, safer rotation when leaks happen.
• Local development remains workable without normalizing unsafe practices.

Example Inputs

• "We currently store secrets in env vars; what's safest?"
• "Developers keep accidentally committing .env files."
• "How do we handle local dev secrets without sharing prod creds?"

Tips

• The best copyable secret is no copyable secret.