skills.rest
Nandansai08
Nandansai08COMMUNITY
Explore all skills by this author →
WebsiteGitHub

secrets-management

Manages credential storage, delivery, rotation, and leak prevention across code, CI, and infrastructure.

1|Updated Jul 3, 2026
Search Tags:#secrets management#vault#credential rotation#oidc#gitleaks#workload identity#ci security
One-click install
npx skills add https://github.com/Nandansai08/skillz --skill secrets-management-nandansai08
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets-management
Source: https://github.com/Nandansai08/skillz/tree/main/skills/devops-cicd/secrets-management
Command: npx skills add https://github.com/Nandansai08/skillz --skill secrets-management-nandansai08

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Credentials end up committed to git, baked into Docker images, or shared as one org-wide key, turning a single leak into a multi-team crisis. This Skill provides a systematic workflow for deciding where secrets live, how they reach runtime, and how to rotate them routinely. ## Core Features & Use Cases - Identity-first design: Replace stored credentials with workload identity, OIDC federation for CI-to-cloud auth, and managed identities wherever the platform supports it. - Tiered storage and delivery: Choose the right store per environment (secrets manager for production, CI secret stores for pipelines, gitignored .env for local dev) and inject secrets at runtime without persisting them in images, configs, or logs. - Rotation and leak prevention: Implement two-key overlap rotation, per-service scoping, gitleaks/trufflehog scanning, push protection, and audit-log monitoring. - Use Case: Auditing a payments service, you find AWS keys in GitHub repo secrets, a DB password in git history, and a Stripe key in a Docker layer. The workflow guides you to OIDC federation, a secrets manager with per-env values, runtime injection, and a practiced 15-minute rotation runbook. ## Quick Start Audit how my application currently gets its secrets and propose a storage, rotation, and scanning setup following the secrets-management workflow.

Frequently Asked Questions about secrets-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I store secrets in CI pipelines securely?▼

Use the CI platform's secret store, such as GitHub environment-scoped secrets, never repo variables or encrypted-in-repo blobs. Prefer OIDC federation with id-token: write in GitHub Actions so CI authenticates to cloud providers without any stored long-lived key.

Should I use environment variables or a secrets manager for API keys?▼

Production secrets belong in a secrets manager like AWS Secrets Manager, GCP Secret Manager, or Vault, which provide audited access and rotation hooks. Environment variables are acceptable as a runtime delivery mechanism injected at start, but they cannot tell you who read them.

Are Kubernetes Secrets encrypted by default?▼

No. Kubernetes Secrets are only base64-encoded in etcd unless encryption-at-rest is explicitly configured, and base64 is trivially reversible. You must enable encryption-at-rest and access control separately for real protection.

How do I prevent secrets from being committed to git?▼

Combine three mechanical layers: a pre-commit hook, CI scanning with gitleaks or trufflehog, and GitHub push protection. Also scan .env.example files, since they accumulate real values when someone copies in the wrong direction.

What should I do if a secret has already leaked?▼

Handle the active leak with an incident response process first: revoke and rotate the exposed credential immediately. Only after containment should you return to fixing the underlying storage, scoping, and delivery system that allowed the leak.

How often should credentials be rotated?▼

Rotation should be a routine, practiced operation using the two-key overlap pattern: issue key B, deploy consumers reading B, then revoke A. If rotation requires a coordinated multi-team effort, fix the deploy path until rotation becomes boring.

Related Skills

Explore More Software Engineering Skills→
JiggerFJiggerF

pr-impact-test

Map PR diff files to affected test suites and run targeted vitest commands.

Community
Advanced
prapanchprapanch

secrets-hygiene

Enforce secret storage, logging, detection, and rotation practices in CI/CD workflows.

Community
Intermediate
wgpsecwgpsec
45

AWS Security Hardening

Enforces AWS security best practices for IAM, networking, and data protection.

Official
Advanced
oborchersoborchers
28

zero-static-credentials

Enforce short-lived token-based access patterns for human, CI/CD, and operational access.

Community
Advanced