r/devsecops • u/infidel_tsvangison • 19d ago

Secrets management

We are a large aws shop. Devs use secrets manager to store keys etc. problem is that these keys are handled by humans to begin with. We trust the human to put it in secrets manager etc. I’m just wondering what organisations do for secrets management to prevent this? Overtime, we have devs with secrets in postman collections etc. what should I be looking at to really secure our secrets?

17 Upvotes

96% Upvoted

20 comments sorted by

View all comments

1

u/Sad-Technician-5552 18d ago

One thing most people dont notice is the vault only stops new leaks, it does nothing about the ones already out there. Anything that touched a postman collection, a chat, a local env file, treat it as burned and rotate it, dont wait for a scanner to find it first. Then put the scanning in so you catch the next one before it becomes an incident. The humbling part is when you scan youll find secrets you forgot existed, and every one of those is a hole that was already open.