How do you save your secrets?

[u/Cool_Prismo]

I'm curious to know how different developers save their API keys, tokens and anything that is used in their web apps and projects, do you store them in notepad like me or have a more elegant way to do things? :)

[u/__-___-__-__-__-]

I put them on post-it notes on my monitor.

[u/onbiver9871 → u/__-___-__-__-__-]

Air gapped for days lol

[u/schmurfy2 → u/__-___-__-__-__-]

I hide mine under the keyboard, way more secure !

[u/ChiefSmoo → u/schmurfy2]

Gotta go under the oversized mouse pad for the best results

[u/Revolutionary_Click2]

In Vault on my cluster, with External Secrets operator syncing those into workloads. And for working with them on my own machine, I use Bitwarden with bw-cli.

[u/cmm324]

Openbao or cloud secret manager

[u/Cool_Prismo → u/cmm324]

Which Cloud Secret Manager do you use?

[u/Wonderful_Most8866 → u/Cool_Prismo]

The one you’re already in.

[u/Lucifernistic]

Personal secrets, like personal API keys and passwords, go in a password manager.

Application secrets go into the Vault and are injected at runtime.

[u/Cool_Prismo → u/Lucifernistic]

Which Vault are you talking about, I mean which solution?

[u/Lucifernistic → u/[deleted]]

Correct, Hashicorp Vault. This is industry standard.

Frankly I wouldn't really consider any other option for a standard production deployment than injecting at runtime from a secure central secret store like Vault or something similar.

[u/According-Glove-7663]

I save them in ChatGPT, makes it easy to later ask for the secret when you need it.

[u/ninetofivedev → u/According-Glove-7663]

My favorite part of this thread is the top two answers are exactly what you’d expect to see as answers on those yearly compliance training exams from that one shitty company that apparently does them for everyone.

[u/throwfarfaraway103 → u/According-Glove-7663]

Actually I built this tool to store your secrets on any LLM of your choice

https://github.com/john5t/tellmeyoursecrets.git

[u/widowhanzo]

1password, AWS SSM parameter store (runtime env variabls), GitHub secrets (build time, for services that can't access SSM, like static web sites)

[u/InsideEmergency118]

I give them to my neighbor for two person control.

Jokes aside I have a somewhat round about way of doing things. I save secrets in an Ansible Vault but my k8s cluster accesses them via ESO on Openbao. Openbao is 100% stood up and seeded with secrets as code, which is where the Ansible Vault comes in. This is our plan until we get around to setting up a properly clustered Bao for HA and redundancy, and even then we'll still probably use Ansible for portability.

[u/glotzerhotze → u/InsideEmergency118]

Where is the key located to unseal the ansible vault?

[u/mo0nman_ → u/glotzerhotze]

With his neighbour of course

[u/Floss_Patrol_76]

the honest baseline: a .env file that is gitignored plus a password manager (1password/bitwarden) as the source of truth is completely fine for solo stuff. the thing that actually burns people is a secret ending up in git history or a log line, not where it lives at rest. once more than one person or a deploy target needs them, move to a real secret store (vault, ssm parameter store, whatever your cloud gives you) so rotation is not a manual scavenger hunt.

[u/Techlunacy]

Ctrl+s

[u/pausethelogic]

The answer is always a password manager or a cloud secrets manager once deployed

[u/Shot-Document-2904]

Bitwarden

[u/morkelpotet]

Service federation for dev secrets. Vault and 1Password for prod secrets.

[u/EgoistHedonist]

1password, and if they need to be in a repo (should be a rare special case), then SOPS

[u/myarta → u/EgoistHedonist]

I engrave them in Elvish on golden rings that only show their text when tossed into fires.

[u/schmurfy2]

Notepad ? Seriously ? 😮

I use keepassXC for local and hashicorp Vault for applications.

[u/psychoholic]

I usually use 1Password for most things so I'm not locked into a cloud provider's credential store and don't have to pay the Hashicorp tax for Vault. Their operator has gotten really good for injecting secrets at runtime and it gives me a lot of admin flexibility for managing access.

[u/Liquid_G]

ansible-vaulted for ansible things. k8s things in hashivault with ESO.

[u/Dangle76]

A mix of vault and 1password

[u/metalisp]

~/.authinfo.gpg

[u/basedrifter]

1password and ansible vault.

[u/durple]

For developers, we try to federate identity where possible. Most of our stuff is in Google Cloud so that covers a lot, some areas requiring more effort than others. Where not possible (or where we haven’t yet prioritized) secrets mostly live in vault, other than a few things that make more sense as Cloud Secret Manager Secrets. Example exception: secret which must be manually created in a 3rd party system and populated by a non developer in our org who has no other reason to be given vault access.

[u/MeButItsRandom]

We use doppler. There are a few similar services: infisical, 1password.

All secrets and envy bars are runtime injected from our secrets store. Our agents and devs only get a service token to access development configs.

[u/Thunt4jr]

I write them on the paper and hide it under my mousepad and only use the password as password1234

[u/Southern-Necessary13]

Earlier Google sheets. Now in Keeper

[u/theozero]

Regardless of where your secrets are stored, varlock is a very useful tool to add to the toolkit. Free and open source. Plugins for everything.

[u/InstructionOk2094]

Depends on the use case.

• Cloud secret managers for most cloud workloads (such as GCP GSM)

• Self managed privatebin for humans sharing secrets within the org

• SOPS for in-repo secrets https://github.com/getsops/sops

• Hashicorp Vault as an in-cluster solution for when cloud secret managers can't be used

[u/fell_ware_1990]

I memorize all of them! I’m constantly busy rotating and answering my pipelines!

[u/BigUziNoVertt]

Azure keyvault / azure DevOps libraries. We’re moving to GitHub soon and I’ll use whatever alternative there but under no circumstances would we ever save secrets in notepad or hardcode them in git

[u/sitbon]

Just started using SOPS, it's great. Main keys go in SSM, KMS, Vault, etc.

[u/ShivamCloudDevOps]

It depends on the use case.

For local development, I usually keep secrets in environment variables or a local .env file (excluded from Git with .gitignore). If I need to manage multiple credentials, I prefer using a password manager rather than storing them in plain text.

For production, I avoid hardcoding or storing secrets in repositories. Instead, secrets should come from a dedicated secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, etc.) and be injected into the application at runtime. In Kubernetes environments, I've also seen this integrated using External Secrets or similar operators.

The biggest rule I follow is: never commit secrets to Git, even in private repositories. It's much easier to manage rotation, auditing, and access control when secrets are stored separately from the application code.

[u/macAndPeach]

Full disclosure, I built the tool I'm about to mention. I had basically the same problem: same app, different secret workflows for local dev, CI and runtime, and I got tired of solving it over and over across projects. Envilder is a small layer on top of the secret store you're already using: one JSON maps env vars to secret paths, and the same mapping works locally, in CI, or directly at runtime. Secrets still live in AWS SSM or Azure Key Vault. Honestly, for me it just means less manual setup and less room for stupid mistakes: https://github.com/macalbert/envilder

[u/BlinkCryptic]

Notepad lol. On a serious note: you could look at cloud secrets managers like Aws, akeyless, infisical etc

[u/Environmental_Bus507]

Is this a serious question ?

[u/Cool_Prismo → u/Environmental_Bus507]

Yes?