Chapter 1 · Practice 2 of 5
Use a secrets manager once more than one person or service needs a secret
Why it matters
Once more than one person or service needs a secret, ad hoc sharing stops working. OWASP recommends centralizing secrets in one system with consistent rules for who can access them, plus an audit trail. Pasting values into chat, wikis or shared documents spreads copies you can never fully track or revoke.
Use what your platform already offers:
| Setup | Good fit |
|---|---|
| Cloud secret store | AWS Secrets Manager, Google Secret Manager, Azure Key Vault |
| Self-hosted or multi-cloud | HashiCorp Vault |
| Hosting platform | Encrypted environment variables in Vercel, Netlify or Render |
Your app or platform reads secrets from the store at deploy or start time, so nobody has to copy a value by hand.
A good check: a new teammate can get access to everything they need without anyone sending a secret in a message. If onboarding still involves "DM me and I will send you the key", the store is not doing its job yet.
Avoid
- Sharing secrets in Slack, WhatsApp or email
- A shared spreadsheet or doc of passwords
- One personal account that owns every key