Secrets Management — From .env Chaos to Vault Discipline
Level 0: .env in chat
Secrets in Slack, screenshots, and committed .env files — the starting point for most teams and the source of most leaks. Immediate fixes: git-secrets pre-commit hooks, .env in .gitignore verified, and rotating anything ever pasted anywhere.
Level 1: Platform secrets
Vercel/AWS environment storage with per-environment scoping, preview deployments on test keys only, and documented rebuild requirements for NEXT_PUBLIC_ changes. Good enough for most startups with disciplined access reviews quarterly.
Level 2: Vault with rotation
HashiCorp Vault or AWS Secrets Manager with 90-day rotation, least-privilege service identities, and audit logs of every secret access. Required for SOC 2 trajectories and enterprise vendor reviews.
The non-negotiables at every level
Separate keys per environment, no secrets in client bundles (audit with bundle analysis), no secrets in logs (redact patterns in the logging pipeline), and a practiced revocation runbook — because leaks happen to disciplined teams too.
Related Articles
Preventing Supply-Chain Attacks in JavaScript Projects
Lockfiles, provenance, and minimal dependencies: hardening the npm install pipeline.
Rate Limiting & DDoS Basics for Application Developers
Token buckets, per-endpoint limits, and Cloudflare tiers: stopping abuse before it becomes an incident.
OWASP Top 10 for 2026 Web Apps — What Changed
Broken access control still leads; API abuse and supply-chain risks climb. Practical fixes per category.
Written by Security Consultant
Specialized engineering teams at Omnetra focus on writing high-performance code, ensuring API security, and optimizing layouts for client success.