FDE Foundations · Module 9: Production
Secrets and Configuration
Secrets leak through code, logs, and convenience. Keep them in a managed store, inject at runtime, never log them, and rotate on a schedule the customer's security team signs off.
10 min reading
Objectives
- Store and inject secrets without putting them in code
- Rotate credentials on a schedule the customer accepts
- Separate configuration from secrets and document both
Where secrets live
A managed secret store (the platform's vault or the customer's standard) is the single source. Code references names, values arrive by injection at runtime. The rules that prevent 90 percent of leaks: no secrets in git, ever; no secrets in logs; no secrets in issue trackers or chat; different values per environment so staging cannot touch production systems.
Rotation
Agree a rotation schedule per credential class (database, API keys, signing secrets) and automate it where the platform allows. Rotation without downtime needs double-credential windows: issue the new value, verify, revoke the old. Practice the rotation once in staging before you promise it.
Separation and documentation
Configuration (tunables) and secrets (credentials) are different files with different lives. Document both: which variables exist, which are required, which are secret, and who owns each. When the security questionnaire arrives, this documentation is the answer to half its questions.
Leak response
Have the drill ready: revoke, rotate, assess exposure, notify per the customer's process. The response plan written before the leak is the difference between an incident and a career event.
Quick check
An optional 2-3 question self-check. Answers never leave your device, are not stored, and never count toward any assessment.
Exercise
Write the secrets plan for a fictional deployment at a bank customer: the store, four credential classes with rotation windows, the double-credential rotation steps, and the leak drill.
Pass criteria
Managed store named, four classes with windows, rotation steps keep service online, and the drill includes revocation, exposure assessment, and notification order.