Foundation · 2 min
What you need to know
What is a secret in application security?
A secret is confidential material that grants access or enables cryptographic operations, such as an API key, private key, password or database credential.
Where should ecommerce API secrets be stored?
Store API secrets in a managed secret service or protected runtime configuration with restricted access, encryption, auditability and rotation support.
Should credentials be stored in source code?
No. Source code and its history are widely copied and hard to clean. Applications should retrieve secrets securely at runtime.
What is secret rotation?
Secret rotation replaces an existing credential or key with a new one and retires the old value without losing control of service continuity.
When should credentials be rotated?
Rotate on exposure, suspected misuse, personnel or ownership changes, cryptographic changes, and a documented risk-based schedule. Test emergency rotation before it is needed.
What should happen if a credential is exposed?
Revoke or restrict the exposed credential immediately where safe, identify its permissions and use, replace it securely, investigate access and fix the disclosure source.
A quick store check
Search approved repositories and deployment settings for secret patterns, then rotate any exposed or ownerless credential.
Foundation · 2 min
Frequently asked questions
Can one secret be shared across all environments?
Avoid it. Separate environments and services, so one exposure does not unlock unrelated systems.
Should rotated secrets remain active as a fallback?
Only for a short controlled transition; retire and verify the old credential promptly.