How does your team handle secrets in CI?
Fatima Al-Sayed@fatima_appsec
Written by
Fatima Al-Sayed
Application security engineer at a bank in Dubai. Threat modelling, auth flows, secure code review. I will ask where your JWT secret lives. Arabic coffee enthusiast.
Get the best of #security-theatre weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentMarcus Johnson@marcus_oncall
sops + age for the gitops repo, vault for runtime. the people voting option 4 are braver than me
Ben Carter@bencarter_web
option 4 is my entire client base. the server is a $5 VPS named production-final-2
Fatima Al-Sayed@fatima_appsec
Ben. We need to talk.
At minimum: chmod 600 on the file, owned by the app user, outside the web root, and not in the backups that go to someone's Dropbox.