Module 4 · Hands-on defence Lesson 12 of 15
Secrets, keys and password managers
A secret in a Git repository is a secret that is already public. Keys, tokens and passwords belong in a manager or the environment, never in the code, and a committed key must be rotated, not deleted.
The concept
A password manager is how a person keeps a different long password for every site; a secrets manager does the same for code. Reuse is the thing that turns one breach into ten.
Add a scanner to the pipeline so a secret never lands in the first place, and treat the removal of one as an incident with a rotation, not a quiet edit.
# look for secrets before they ship
grep -rniE 'aws_secret|api[_-]?key|password *=' --include='*.py' --include='*.js' .
# if a key WAS committed:
# 1. revoke it in the provider (deleting the commit is not enough)
# 2. issue a new one
# 3. load it from the environment: export API_KEY=...
# 4. add a scanner (gitleaks / trufflehog) to CIWorked example
An AWS key pasted into a repo is found by scanners within minutes; deleting the commit does not help because the history keeps it - the key must be revoked and replaced.
Your practice task
Search your own repositories for a key-like string and move anything found into an environment variable.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
A password manager is how a person keeps a different long password for every site; a secrets manager does the same for code.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.