Cybersecurity Secrets Management

How it works

Secrets include service credentials, signing keys and recovery tokens. Store them outside committed source and give services access only to the values they need. Rotation must update consumers and invalidate the old value; changing a variable name is not rotation. Redaction helps prevent accidental logging, but a broad logging policy is needed because secrets can appear in URLs or free text.

Run the code

Save the complete source as secrets-management.py in a separate learning folder, then run python secrets-management.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

def diagnostic(config):
    return {"service": config["service"], "api_key": "[redacted]"}
config = {"service": "reminders", "api_key": "public-demo-placeholder"}
record = diagnostic(config)
assert config["api_key"] not in str(record)
assert record["service"] == "reminders"
print(record["api_key"])

Expected result

[redacted]

The diagnostic function selects approved fields rather than copying an entire configuration and hoping to remove every sensitive value. The sample key is a public placeholder. Test the actual logging path, including exceptions and HTTP request logging, before claiming that a real secret cannot leak.