Secrets in code and in logs

A key committed once stays in the history even after the file is changed. A password printed in a log can be read by everyone who can read the log.

Where we look

• Source repositories, including old commits and forks.
• Configuration files and environment dumps left on servers.
• Build and deployment output.
• Application and error logs.
• Front-end code, which anyone can read.

What to do

1. Rotate first. If a secret was exposed, assume it was copied, and replace it.
2. Keep secrets in a dedicated store, not in the code.
3. Scan repositories automatically before changes are accepted.
4. Make logs avoid sensitive values by design.
5. Give each secret the narrowest permissions it needs, so a leak has limited reach.

Removing a secret from the code without rotating it only hides the problem.