انتقل إلى المحتوى الرئيسي

Secret Management

Best practices for managing secrets and sensitive configuration.

Secret Categories​

CategoryExamples
AuthenticationJWT_SECRET, JWT_REFRESH_SECRET
DatabaseDB_PASS, connection strings
File storageAWS_SECRET_ACCESS_KEY, WASABI_SECRET_ACCESS_KEY
OAuthGOOGLE_CLIENT_SECRET, GITHUB_CLIENT_SECRET
EmailMAIL_PASSWORD, SMTP credentials
IntegrationsSENTRY_DSN, API keys
Private registryVERDACCIO_TOKEN

Storage Methods​

Store secrets as environment variables, injected at runtime:

export JWT_SECRET=$(openssl rand -base64 32)
export DB_PASS=$(openssl rand -base64 24)

Docker Secrets​

For Docker Swarm deployments:

secrets:
  db_password:
    external: true
services:
  api:
    secrets:
      - db_password

GitHub Secrets​

For CI/CD pipelines, store secrets in GitHub Secrets:

env:
  JWT_SECRET: ${{ secrets.JWT_SECRET }}
  DB_PASS: ${{ secrets.DB_PASS }}

Cloud Secret Managers​

ProviderService
AWSAWS Secrets Manager
GCPGoogle Secret Manager
AzureAzure Key Vault
HashicorpVault

Security Practices​

PracticeRecommendation
Secret rotationRotate every 90 days
Minimum privilegeGrant only required access
Audit loggingLog secret access
No hardcoded secretsNever commit to git
Separate per environmentDifferent secrets for dev/prod