# Secrets, the Boring Way

> Most secret failures are a credential in a place nobody counted as a place.

Source: https://christwentyfour.com/blog/secrets-the-boring-way

Most secret failures are not about cryptography. They are a credential in a place nobody counted as a place.

## The real threats

- A credential committed to a repo years ago, still valid.
- A key in an environment variable that a debug log prints.
- A shared password in a document, used by six people, one of whom has left.
- A long-lived access key on a laptop, belonging to someone who changed teams.

None of these takes skill to exploit. A better vault does not stop them.

## Remove long-lived credentials

A federated role that issues a one-hour token leaves nothing durable to leak. CI is the common case. A pipeline with stored permanent keys is an obvious target. Every major CI system supports short-lived credentials through federation. Moving over is usually an afternoon.

## Scope matters more than rotation

A credential that reads one bucket is a small problem if it leaks. Start every permission set at nothing, and add what fails. Copied policies are almost always too wide.

## Assume it will leak

How long would it take to revoke a credential right now, and what would break? If nobody knows, rehearse it once on something low-stakes.

## Make the safe path the short one

If getting a secret the right way takes four steps and pasting it into a file takes one, the file wins. Policy will not change that.