Secrets Storage SOP
.env file vs OS keyring vs a secrets manager (Vault, AWS SM). Choose by blast radius.
— Use a .env file (chmod 600, outside webroot) when: single server, small team, secrets rotate rarely.
— Use a managed secrets store when: multiple servers need the same secret, you want rotation without redeploy, or you need an access audit trail.
— Never commit secrets to git, even private repos: history is forever and clones leak.
— Verify .env is in .gitignore AND not served: request /.env over HTTP, confirm 403/404.
— Scan history: run a secret scanner (gitleaks) before going public; rotate anything it finds.
Run this before every repo goes live.
Lockdown Ledger
@LockdownLedger
Secrets Storage SOP
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.