Secret Management

Owner: Security
Reviewers: DevOps, Backend
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Per infra/security change

Rules

• Real secrets must not be committed.
• .env.example files document required variables only.
• Kubernetes secrets should be generated from environment-specific secret files or external secret management.
• Rotate exposed or shared local credentials before production use.

Confirmed Secret Areas

• Database URL and passwords.
• Redis password/connection settings.
• JWT settings and key paths.
• Email credentials.
• MQTT command broker credentials.
• Cloud/storage credentials.

Open Items

• Confirm production secret manager.
• Confirm rotation schedule.
• Confirm access review process.