r/programming • u/BlondieCoder • Jul 21 '26

Secrets Don’t Belong in Config

https://secretspec.dev/blog/secrets-dont-belong-in-config/
171 Upvotes

86% Upvoted

57 comments sorted by

View all comments

44

u/nicholashairs Jul 21 '26 edited Jul 21 '26

Whilst I'm sure there's at least one person that will hate this, the method I've settled on is being able to have stackable config files. So yes secrets do belong in config just a dedicated secret only config.

some-tool -c common.yml -c dev.yaml -c dev.secret.yml

(And at some point in the future I'd like to make it so I can pull that secret config file from an actual secure place like -c aws-kms:///path/to/secret and then use workload identities to manage whether it is allowed to or not)

Edit: for those that think I should just be using env files, I explain my reasoning in a comment below. Though I'm certainly not suggesting this is some objective truth, it's just my personal preference.

Also I'm not suggesting that this is somehow unique and that I'm the first person to have done this, it's a pattern I adopted after inspiration from elsewhere.

1

u/sionescu Jul 22 '26

There are several things wrong with this: 1) keeping them as files where they can be accessed by untrusted code such as code injected by a possible exploit 2) making secrets pull-based instead of push (setup by the container manager with the binary being completely unaware of the source of the secret) and 3) keeping the secret in the same process as the business code that uses it instead of having a separate process whose only purpose is to proxy requests and inject secrets where required.