Secrets Management
Storing, distributing, rotating and auditing credentials so that they never live in code, images or configuration files.
The baseline is a dedicated secret store — cloud-native or Vault — with access controlled by workload identity, and secrets injected at runtime rather than baked into an artefact. A secret in a container image is in the registry, in every layer cache and in everyone's laptop.
The maturity step beyond that is dynamic secrets: the store issues a short-lived credential per workload per session, so there is no long-lived secret to leak and rotation is continuous rather than an annual project.
Two things worth building early because they are painful to retrofit: automated rotation that applications can tolerate without a restart, and secret scanning in CI, since the most common leak path remains a credential committed to a repository.