Cybersecurity glossary
What is Secrets Management?
Learn what secrets management is, how vaults and identity-based access reduce credential risk, and how it differs from secret scanning.
Definition
Secrets management is the controlled storage, issuance, access, rotation, auditing, and revocation of sensitive credentials such as passwords, API keys, tokens, certificates, and encryption keys.
Why secrets management matters
Applications need credentials to talk to databases, cloud APIs, package registries, payment systems, and internal services. When those credentials are copied into source code, chat, laptops, or CI variables with broad permissions, one leak can become full environment access.
Secrets management matters because it makes credential handling a controlled lifecycle instead of a scattering of long-lived strings. The goal is to issue the least powerful secret for the shortest practical time and know exactly who or what used it.
What secrets management controls
Secure storage
Secrets live in vaults or managed platforms with encryption, access policy, and audit trails.
Identity-based access
Workloads and users receive secrets based on authenticated identity and least privilege.
Rotation and revocation
Credentials can be replaced, expired, and disabled without relying on manual cleanup.
Usage visibility
Audits show when secrets were created, read, changed, and revoked.
How secrets should flow
Create with purpose
A secret is issued for a defined application, environment, permission set, and owner.
Store centrally
The value is kept in a vault or platform service, not source code, images, tickets, or docs.
Grant by identity
Applications authenticate as workloads and receive only secrets they are authorized to use.
Inject at runtime
Deployment systems provide secrets just-in-time through mounted files, APIs, or protected variables.
Rotate regularly
Secrets are replaced on schedule, on role change, and immediately after suspected exposure.
Audit and revoke
Access logs and ownership reviews remove unused, overbroad, or suspicious credentials.
Secrets management patterns compared
| Pattern | Best for | Watch out for |
|---|---|---|
| Static shared secret | Legacy systems that cannot use identity-based access | Long lifetime, broad blast radius, and hard rotation |
| Central vault | Most applications needing controlled storage and audit | Access policy design and availability of the vault |
| Dynamic secret | Databases, cloud roles, and short-lived workload access | Application compatibility with expiration and renewal |
| Keyless / workload identity | Cloud-native services and CI using federated identity | Misconfigured trust relationships can overgrant access |
Secrets management checklist
- Keep secrets out of source code, images, package artifacts, tickets, and chat.
- Use a managed vault or platform secret store with encryption and audit logging.
- Grant access by workload identity and least privilege, not shared human accounts.
- Prefer short-lived dynamic credentials where applications can support them.
- Rotate secrets on schedule and immediately after suspected exposure.
- Mask secrets in logs, crash reports, traces, and CI output.
- Review unused, stale, and overprivileged secrets as part of access governance.
- Pair secrets management with secret scanning to catch leaks when controls fail.
The practical takeaway
Secrets management prevents credentials from becoming unmanaged production skeleton keys. It is the lifecycle discipline for creating, storing, issuing, rotating, auditing, and revoking sensitive values.
Secret scanning finds leaks after they happen. Secrets management reduces how often leaks happen and how much damage any single leaked credential can do.
Related security terms
Secret Scanning
Detection of secrets that escaped into code, logs, artifacts, or collaboration systems.
CI/CD Pipeline
The automation environment where secrets are frequently injected and used.
Secure by Default
Defaults that make safe credential handling the easiest path.
Infrastructure as Code (IaC)
Declarative infrastructure that must reference secrets without embedding them.
Software Supply Chain Attack
Attacks that often use stolen secrets to reach pipelines, registries, and cloud accounts.
Frequently asked questions
What is secrets management in simple terms?
It is the system and process for keeping credentials out of code, giving them only to the right workloads, rotating them, and auditing their use.
How is secrets management different from secret scanning?
Secrets management stores and issues secrets safely. Secret scanning detects secrets after they leak into places they should not be.
What counts as a secret?
Secrets include passwords, API keys, OAuth tokens, database credentials, private keys, certificates, signing keys, and cloud access tokens.
Should applications store secrets in environment variables?
Environment variables can be acceptable in some platforms, but they still need secure injection, masking, least privilege, rotation, and controls that prevent logging or dumping.
What is secret rotation?
Rotation replaces a credential with a new value and revokes the old one, ideally without downtime and with clear evidence that consumers moved.
What are dynamic secrets?
Dynamic secrets are short-lived credentials issued on demand for a specific workload, identity, scope, and lifetime.
Who should have access to production secrets?
Access should be limited to specific workloads and break-glass operators, approved through identity policy, logged, time-bound, and reviewed.
References
Explore authoritative guidance and frameworks related to secrets management.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.