Secret management refers to the secure storage, rotation, and access control of sensitive values such as API keys, passwords, tokens, certificates, and encryption keys. Secrets must never be hard-coded in repositories or exposed in logs. Modern systems use dedicated secret managers, environment variables, or hardware security modules (HSMs) to ensure strong protection.
Why it matters
Poor secret handling is a major source of security breaches. Secret management prevents unauthorized access, credential leakage, and privilege escalation. It also supports compliance requirements and reduces operational risk across distributed systems.
Examples
Using AWS Secrets Manager to store database credentials, or Vault to rotate API keys automatically.