secret management
Supply credentials through an appropriate secret store or runtime configuration.
Use this when An integration needs a credential in development and deployment.
without the term
“I pasted my Stripe key directly into the code to get it working. How should I store API keys so they're not in git or visible in the browser?”
with the term · How do you ask a model for secret management?
Move this credential to runtime secret configuration. Validate missing configuration and verify the value is absent from source, logs, and client output.
What is secret management?
API keys and passwords come from environment variables or a secret manager at runtime. They never appear in the repository, the client bundle, or the logs.
Why does secret management matter when vibe coding?
An agent can accidentally embed a real value in an example or error report.
How do you do secret management?
Document variable names, inject values at runtime, and inspect release output for accidental exposure.
What goes wrong with secret management?
Rotating the environment value while an older leaked credential remains valid.