Enforce secrets hygiene end to end

Steps

1. 1Generate long random secrets via managers; ban hand-invented passwords
2. 2Inject at runtime from vault/KMS; forbid .env commits with real values
3. 3Pre-commit hooks scanning for high-entropy strings and known key formats
4. 4Rotate on schedule AND immediately after any suspected exposure
5. 5Scope every key least-privilege; prefer short-lived credentials
6. 6Practice the leak playbook: revoke → rotate → audit access → postmortem

Common Pitfalls

• ▲Rotated old keys never actually revoked
• ▲Service accounts sharing one god-mode credential

Commands

$ npx skills add aniruddhaadak80/skills --skill application-security-secrets-hygiene

$ npx skills add aniruddhaadak80/skills --skill application-security-secrets-hygiene -g

Tags