What is a Secret?
Imagine you have a safe deposit box at a bank. The key to that box is something you guard carefully — you don't tape it to the outside of the box, leave copies in public places, or hand it to strangers. In software, a "secret" is exactly that kind of key: a piece of sensitive information that proves your identity or grants access to a protected resource.
Concrete examples of secrets include:
- Database passwords (
postgres://app:supersecretpassword@db:5432/prod) - API keys for external services (Stripe, Twilio, OpenAI, SendGrid)
- TLS/SSL private certificates used to encrypt network traffic
- Service account credentials for cloud providers or internal systems
- Encryption keys used to protect data at rest
The "Secret Sprawl" Nightmare
Before specialized secrets management tools existed, developers often took the path of least resistance: hardcoding secrets directly into source code, storing them in unencrypted .env files committed to Git, or setting them as plain-text environment variables on servers.
This leads to secret sprawl — secrets end up scattered across dozens of places simultaneously. They live in Git history (where git log exposes them forever, even after deletion). They exist on every developer's laptop who ever cloned the repo. They appear in CI/CD build logs. They get copied into Slack messages and Jira tickets. If an attacker gains read access to your codebase, a misconfigured S3 bucket, or a single server, they instantly have the keys to your entire kingdom — database access, payment gateways, third-party APIs, everything.
Secrets Management is the discipline and tooling used to centralize, encrypt, tightly control access to, and audit the usage of sensitive credentials. The core idea is simple: secrets belong in a dedicated secure system, not in your code, not in your config files, and not in your head.
Why This Matters at Scale
At small scale, secret sprawl is embarrassing. At enterprise scale, it is catastrophic. The 2022 Uber breach, the 2019 Capital One breach, and countless others involved attackers finding credentials in places they should never have been. The discipline of secrets management exists specifically to eliminate the attack surface created by credentials living outside a controlled system.
Interviewers frequently ask: "How do you handle secrets in your CI/CD pipeline?" A weak answer is "we use environment variables." A strong answer explains the full chain: secrets are stored in a dedicated system (Vault, AWS Secrets Manager), the CI/CD runner authenticates using a short-lived identity (OIDC token, IAM role), fetches only the secrets it needs for that specific job, and those secrets are never logged or persisted. Mention that you audit access and rotate credentials regularly.