Secret Management

Owner: Security
Reviewers: DevOps, Backend
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Per infra/security change

Rules

  • Real secrets must not be committed.
  • .env.example files document required variables only.
  • Kubernetes secrets should be generated from environment-specific secret files or external secret management.
  • Rotate exposed or shared local credentials before production use.

Confirmed Secret Areas

  • Database URL and passwords.
  • Redis password/connection settings.
  • JWT settings and key paths.
  • Email credentials.
  • MQTT command broker credentials.
  • Cloud/storage credentials.

Open Items

  • Confirm production secret manager.
  • Confirm rotation schedule.
  • Confirm access review process.