Secrets management

Secrets belong in a manager, injected at runtime, never in the repository. Assume anything committed once is compromised forever.

What this lesson covers

• Keep credentials out of source control
• Inject secrets at runtime and scope them tightly
• Rotate credentials and revoke exposed ones immediately

This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.