Secrets management

Passwords, keys and tokens that software needs in order to work have to live somewhere, and that somewhere should be built for the job.

What happens instead is that they end up in source code, in config files, in chat messages and in spreadsheets, because those are convenient at the moment somebody is trying to get something working. A proper secrets system stores them, hands them out on demand, records who asked and can replace them without a code change. The test of whether you need one is simple: could you rotate a key today without knowing in advance what would break.